Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck
CVE-2026-109399SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates
High 8.1
In plain English
A high-severity improper certificate validation in swupdate from sbabic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can embed that intermediate in the signature to install malicious updates.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | swupdate | 2022.12+dfsg-4+deb12u3 | DEBIAN-CVE-2026-109399 |
| Debian:14 | swupdate | 2026.05+dfsg-1 | DEBIAN-CVE-2026-109399 |
| Ubuntu:22.04:LTS | swupdate | no fix listed | UBUNTU-CVE-2026-109399 |
| Ubuntu:24.04:LTS | swupdate | no fix listed | UBUNTU-CVE-2026-109399 |
| Ubuntu:26.04:LTS | swupdate | no fix listed | UBUNTU-CVE-2026-109399 |
| Ubuntu:26.10 | swupdate | no fix listed | UBUNTU-CVE-2026-109399 |
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- Researcher Disclosure technical-description, mailing-list
- https://github.com/sbabic/swupdate/commit/e66c5640664a31668926a24c0c84b6b6570dc0d9 patch
- https://github.com/sbabic/swupdate/blob/2026.05.1/crypto/swupdate_cms_verify_openssl.c technical-description
- https://github.com/sbabic/swupdate product
- VulnCheck Advisory: SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates third-party-advisory