CVE-2026-5588

highpriority · track · 0OT risk · elevatedEPSS 0.008 · 56 %ileDEEUFRRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.78% (56th) EPSS

CVSS 7.5 · high

Is it mine?

30 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules). This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java. This issue affects BC-JAVA: from 1.67 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 1.7–7.5

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondaryexploitability 3.9 · impact 3.6

v4.06.3mediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Ambersecondary · ENISA EU

v4.06.3mediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Ambersecondary

v4.01.7lowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Ambersecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-327USCWE-327USCWE-327USCWE-347USCWE-347US

affected products (30)

Products and version ranges known to be affected.

Absolute Secure Access <14.60all versionscert_bundDE
Oracle Fusion Middleware 12.2.1.4.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:12.2.1.4.0
Oracle Fusion Middleware 14.1.1.0.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:14.1.1.0.0
Oracle Fusion Middleware 14.1.2.0.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:14.1.2.0.0
Oracle Fusion Middleware 14.1.2.1.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:14.1.2.1.0
Oracle Fusion Middleware 15.1.1.0.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:15.1.1.0.0
Absolute Secure Access< 14.60cert_bundDE
Legion of the Bouncy Castle Inc. BC-JAVA1.67 → 1.80.2enisa_euvdEU
Legion of the Bouncy Castle Inc. BC-JAVA1.81 → 1.81.1enisa_euvdEU
Legion of the Bouncy Castle Inc. BC-JAVA1.82 → 1.84enisa_euvdEU
Legion of the Bouncy Castle Inc. BCPIX-LTS2.73.7 → 2.73.11enisa_euvdEU
Legion of the Bouncy Castle Inc. BCPKIX-FIPS2.0.6 → 2.0.11enisa_euvdEU
Legion of the Bouncy Castle Inc. BCPKIX-FIPS2.1.7 → 2.1.11enisa_euvdEU
Axiom JDK Libercat EE Certified≤ 9.1.3-23fstec_bduRU
Axiom JDK Libercat EE Certified≤ 8.0.16-39fstec_bduRU
Legion of the Bouncy Castle Inc. BC Java1.67 → 1.80.2fstec_bduRU
Legion of the Bouncy Castle Inc. BC Java1.81 → 1.81.1fstec_bduRU
Legion of the Bouncy Castle Inc. BC Java1.82 → 1.84fstec_bduRU
Legion of the Bouncy Castle Inc. BCPKIX FIPS2.0.6 → 2.0.10fstec_bduRU
Legion of the Bouncy Castle Inc. BCPKIX FIPS2.1.7 → 2.1.10fstec_bduRU

showing 20 of 30

advisories (6)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-1129Bouncy Castle BC-JAVA: Mehrere SchwachstellenDeutsch2026-04-15csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Bouncy Castle BC-JAVA ausnutzen, um kryptografische Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
WID-SEC-W-2026-1687IBM License Metric Tool: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffDeutsch2026-05-26csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM License Metric Tool ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
WID-SEC-W-2026-2437Oracle Communications: Mehrere SchwachstellenDeutsch2026-07-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2026-2444Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2026-07-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
GHSA-wg6q-6289-32hpBouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules2026-04-15ghsa · osvUS
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules). PKIX draft CompositeVerifier accepts empty signature sequence as valid. This issue affects BC-JAVA: from 1.49 before 1.84.
CERTFR-2026-AVI-1378Multiples vulnérabilités dans les produits IBMFrançais2026-10-23vendor · certfrFR

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund osv certfr NVD CVE.org MITRE

published 2026-04-15modified 2026-10-26

references (37)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan