Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys. All inner HTTP traffic (patient consent decisions, medication data, document operations, authorization tokens, and entitlement queries) becomes readable and modifiable. The attacker can also inject arbitrary requests through the hijacked channel. This issue has been patched in version 2026-05-20.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-25 | 2 | Active Exploitation1Disclosure1 |
| 2026-07-30 | 1 | Disclosure1 |
CVE-2026-48021 in med-united epa4all allows TLS interception, enabling attackers to read and modify inner HTTP traffic. https://ift.tt/zNUtZ5E
Post summary
The CVE-2026-48021 allows TLS interception over med-united epa4all, and a link is provided that likely hosts a PoC, but no evidence of active exploitation or patch is presented.
Recent critical vulns: Knot Resolver DNS-over-QUIC RCE (CVE-2026-66374), epa4all TLS MiTM (CVE-2026-48021), & Check Point auth bypass (CVE-2026-16232) threaten data privacy/integrity in transit. Act now! [July 25, 2026] #Cybersecurity #NetworkSecurity #ZeroDays
Post summary
The post announces three critical CVEs and their general impact but offers no further technical detail, exploit code, or mitigation information.
Some increased actor activities are shown targeting med-united epa4all (CVE-2026-48021) https://vuldb.com/vuln/383004/cti
Post summary
The message indicates increased attacker activity targeting CVE-2026-48021 but offers no technical, patch, or exploit details.