CVE-2026-28388
highpriority · track · 30EPSS 0.009 · 59 %ileDEEUFRNLRUUSEPSS · scored 2026-10-26
Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference. Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSIMATIC CN 4100siemens_psirt
Update to V5.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814144/ - FixedSIMATIC CN 4100cisa_csaf_ot
Update to V5.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814144/ - FixedRTU500 series CMU Firmwarecisa_csaf_ot
Update to CMU Firmware version 12.7.8 OR
- MitigationSIMATIC S7-1500 TM MFP - GNU/Linux subsystemsiemens_psirt
Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.
- MitigationSIMATIC S7-1500 TM MFP - GNU/Linux subsystemcisa_csaf_ot
Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.
- MitigationRTU500 series CMU Firmwarecisa_csaf_ot
Follow general mitigation factors/workarounds
- No fix availableSIMATIC S7-1500 TM MFP - GNU/Linux subsystemsiemens_psirt
Currently no fix is available
- No fix availableSIMATIC S7-1500 TM MFP - GNU/Linux subsystemcisa_csaf_ot
Currently no fix is available
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (113)
Products and version ranges known to be affected.
- NetApp AFF Baseboard Management Controllerall versionscert_bundDEcpe:/h:netapp:aff:::baseboard_management_controller
- NetApp FAS Baseboard Management Controllerall versionscert_bundDEcpe:/h:netapp:fas:baseboard_management_controller
- Red Hat Ansible Automation Platform 2.6all versionscert_bundDEcpe:/a:redhat:ansible_automation_platform:2.6
advisories (9)
Vendor and ecosystem advisories describing this.
- NCSC-2026-0147Kwetsbaarheden verholpen in Siemens-productenNL2026-05-13csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in verschillende (OT-)producten. Het gaat onder andere om producten in de Siemens RUGGEDCOM-, SCALANCE-, SIMATIC-, SIMIT-, SINAMICS-, SIPROTEC-, SENTRON- en Solid Edge-productreeksen.
- SSA-032379SSA-032379: Multiple Vulnerabilities in SIMATIC CN 4100 Before V5.02026-05-12csaf · siemens_psirtDE
SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
- SSA-265688SSA-265688: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.12024-04-09csaf · siemens_psirtDE
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1. Siemens has released a new version for SIMATIC S7-1500 TM MFP - GNU/Linux subsystem and recommends to update to the latest version. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available. SIMATIC S7-1500 TM MFP V1.1 is no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version. Note: This SSA advises vulnerabilities for firmware version V1.1 only; for version V1.1.1 refer to SSA-784472.
- WID-SEC-W-2026-0995OpenSSL: Mehrere SchwachstellenDeutsch2026-04-07csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in OpenSSL ausnutzen, um einen Denial of Service Angriff durchzuführen, vertrauliche Informationen offenzulegen oder andere, nicht näher spezifizierte Angriffe durchzuführen.
- ICSA-24-102-01Siemens SIMATIC S7-1500 TM MFP2024-04-09icsa · cisa_csaf_otUS
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
- ICSA-26-134-10Siemens SIMATIC2026-05-12icsa · cisa_csaf_otUS
SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
- ICSA-26-293-05Hitachi Energy RTU500 Product2026-09-01icsa · cisa_csaf_otUS
Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. These vulnerabilities if exploited can have impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.
- CERTFR-2026-AVI-1351Multiples vulnérabilités dans Oracle MySQLFrançais2026-10-21vendor · certfrFR
- CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (23)
External citations — patches, advisories, analysis.
- https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2ecnnvd
- https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139cnnvd
- https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3cnnvd
- https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8cnnvd
- https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726cnnvd
- https://github.com/openssl/openssl/releasesPatchcnnvd
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-28388cnnvd
- https://openssl-library.org/news/secadv/20260407.txtcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan