Log in Start free

Vulnerability · Published Sep 6, 2026 · Assigned by VulDB

CVE-2026-86231mwiede jsch KnownHosts.java getRevokedKeys improper check for certificate revocation

Low 3.7

In plain English

A low-severity security flaw in jsch from mwiede. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.4%top 63.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate revocation. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.28.6 is able to address this issue. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. You should upgrade the affected component.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12jschno fix listedDEBIAN-CVE-2026-86231
Debian:13jschno fix listedDEBIAN-CVE-2026-86231
Debian:14jschno fix listedDEBIAN-CVE-2026-86231
Ubuntu:22.04:LTSjschno fix listedUBUNTU-CVE-2026-86231
Ubuntu:24.04:LTSjschno fix listedUBUNTU-CVE-2026-86231
Ubuntu:26.04:LTSjschno fix listedUBUNTU-CVE-2026-86231
Ubuntu:26.10jschno fix listedUBUNTU-CVE-2026-86231

Affected products (as reported)

VendorProductVersions
mwiede jsch 2.28.02.28.12.28.22.28.32.28.42.28.5

Weakness: CWE-299, CWE-298 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

References