Ssmallstep

Products

Exploited and recent CVEs

• CVE-2026-40097 Low 3.7 Step CA affected by an index out of bounds panic in TPM attestation EKU validation 0.2%
• CVE-2026-30836 Critical 10.0 Step CA: Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18) 0.3%
• CVE-2025-44005 Critical 10.0 An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks. 9.1%
• CVE-2025-66406 Medium 5.0 Improper Authorization Check for SSH Certificate Revocation 0.2%