Vulnerability · Published Aug 13, 2026 · Assigned by NCSC.ch
CVE-2026-16459Timing side-channel in RSA PKCS#1 v1.5 decryption in Oberon PSA Crypto
Medium 5.9
In plain English
A medium-severity broken cryptography in Oberon PSA Crypto from Oberon microsystems AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).
Severity (CVSS 4.0)5.9Medium
Exploit odds (30 days)<0.1%top 99.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS#1 v1.5 decrypt operations.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Oberon microsystems AG | Oberon PSA Crypto | 1.0.0 – before 2.1.1 |
Weakness: CWE-208, CWE-327 · Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N