Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve key-equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given message. In one use case, an attacker may send a CMS message containing AuthEnvelopedData with the cipher specified as a non-AEAD cipher. OpenSSL erroneously allows this selection, and attempts to decrypt and validate the message. An on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData addressed to the victim can re-emit it with the recipientInfos set left byte-for-byte intact, so the victim's private key still unwraps the genuine CEK (the content-encryption key), but with the inner OID rewritten to AES-256-OFB (Output Feedback Mode, an unauthenticated keystream mode) and with an attacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the real CEK, never consults the MAC field, and CMS_decrypt() returns success. If the application under attack responds to the attacker with any indicator showing success or failure of the decryption effort, it is possible for the attacker to use this as an oracle to obtain key equivalent functionality for the CEK used for the chosen recipient of the message. In another use case, an attacker can reduce the tag length of the chosen AEAD cipher for a given AuthEnvelopedData container to be a single byte long, allowing an attacker to brute force CMS decryption, producing an integrity bypass for applications that trust CMS_decrypt() to reject modified content. The FIPS modules are not affected by this issue.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-06-09 | 1 | Patch1 |
| 2026-06-11 | 1 | Patch1 |
| 2026-06-13 | 1 | General1 |
| 2026-06-23 | 1 | Active Exploitation1 |
| 2026-09-09 | 1 | General1 |
| 2026-09-18 | 1 | Patch1 |
4/6 To see what is actually in there: apt changelog openssl | grep CVE On mine that lists CVE-2026-34180 and three separate patches for CVE-2026-34182. Both fixed, on a version string that reads unpatched.
Post summary
The text reports that patches for CVE‑2026‑34180 and CVE‑2026‑34182 are present and applied, though the version string incorrectly indicates they remain unpatched.
#windowsupdate #microsoft つづき ・CVE-2026-34182 CMS AuthEnvelopedData Processing May Accept Forged Messages ・CVE-2026-50696 インターネット キー交換 (IKE) プロトコルのサービス拒否の脆弱性 つづく…
Post summary
The post merely lists two CVEs with their short descriptions, providing no further technical, exploit, or mitigation details.
Ep.676 - RadioCSIRT Édition Française - Flash info Au sommaire de cette édition : 🔐 GnuPG corrige la CVE-2026-57062 dans gpgsm : l'analyse du format CMS accepte une longueur ICV de quatre octets au lieu des douze attendus pour AES-GCM, affaiblissant le contrôle d'intégrité. GnuPG jusqu'à 2.5.20 est concerné, en lien avec la CVE-2026-34182. CVSS 3.1 à 2.9. (CVEFeed / MITRE) 🐧 Le noyau Linux 7.1 est publié par Linus Torvalds le 14 juin 2026 : nouveau pilote NTFS en espace noyau (iomap, folios), Intel FRED activé par défaut, contrôles Landlock étendus aux sockets UNIX et suppression de plus de 140 000 lignes de code hérité. (Linux Journal) 🚨 Les agences Five Eyes publient une déclaration commune le 22 juin 2026 sur la transformation du risque cyber par l'intelligence artificielle : réduction de la fenêtre entre découverte et exploitation, appel à traiter le risque comme un enjeu métier, priorité aux fondamentaux et intégration de l'IA dans la défense. (CISA) 🔓 MISP Core corrige la CVE-2026-56423 : un défaut de contrôle d'accès dans les suppressions en masse permettait à un utilisateur contributeur de supprimer définitivement des Event Reports et Sharing Groups d'autres organisations à l'échelle de l'instance. Exploitable à distance. CVSS 3.1 HIGH à 9.4, CVSS 4.0 CRITICAL. (CVEFeed / CIRCL) 🛡️ Le SANS ISC détaille les configurations SonicWall vulnérables après correctif de la CVE-2024-40766 (CVSS 9.3, exploitée par Akira et Fog depuis septembre 2024) : comptes locaux obsolètes, mots de passe non renouvelés, groupe LDAP par défaut trop permissif, portail Virtual Office exposé permettant un contournement MFA. La CVE-2024-12802 vise le contournement MFA sur les équipements Gen 6 en fin de vie. (SANS Internet Storm Center) Pour écouter l'épisode: https://www.radiocsirt.org/podcast/ep-676-radiocsirt-edition-francaise-flash-info-cybersecurite-du-mardi-23-juin-2026/
Post summary
The edition highlights real‑world exploitation of CVE-2024-40766 by Akira and Fog while noting that GnuPG and MISP Core vulnerabilities have been patched.
🪟 MSRC link missing for a fresh OpenSSL CVE? Great, nothing like patch triage while the breadcrumb trail is broken. If CMS can be forged, “just update later” isn’t a plan. #Windows #Microsoft #Security #OpenSSL https://windowsforum.com/threads/cve-2026-34182-openssl-cms-authenvelopeddata-forgeries-and-windows-patch-triage.425779/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #WindowsSecurity #SoftwareSupplyChain https://t.co/vTRPXrK6Ih
Post summary
The post highlights a missing MSRC link for CVE‑2026‑34182, indicating CMS forging issues, but provides no PoC, exploitation details, patch, or false‑positive claim.
OpenSSL patches 16 flaws: CVE-2026-45447, heap use-after-free in PKCS7_verify() with RCE potential via crafted S/MIME. Also: unauthenticated QUIC DoS (CVE-2026-34183) and key forgery (CVE-2026-34182). Check static builds. https://dailysecurityreview.com/resources/openssl-patches-16-flaws-including-heap-use-after-free-rce-risk/ #CyberSecu https://t.co/nC2CFxcNTX
Post summary
The tweet outlines 16 patched OpenSSL flaws, provides technical details on the heap use‑after‑free vulnerability, and advises applying the patches and using static builds to mitigate the risk.
Ubuntu released USN-8414-1 and USN-8414-2 to fix OpenSSL flaws including heap buffer over-read CVE-2026-34180 and CMS forgery bug CVE-2026-34182 affecting Ubuntu 14.04, 16.04, 18.04 and 20.04 LTS, Ubuntu said. https://threatcluster.io/cluster/multiple-openssl-vulnerabilities-disclosed-affecting-ubuntu--5bea36d7
Post summary
Ubuntu issued USN‑8414‑1 and USN‑8414‑2 to patch OpenSSL CVE‑2026‑34180 and CVE‑2026‑34182, providing technical details but no evidence of exploitation or PoC.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openssl | openssl | - | - | - |
| App | openssl | openssl | 4.0.0 | - | - |