CVE-2026-109399 Details
Description
SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can embed that intermediate in the signature to install malicious updates.
A vulnerability exists in SWUpdate versions through 2026.05.1, specifically within the certificate verification process of CMS signatures. The issue arises because the application improperly trusts unverified X.509 certificates embedded in CMS SignedData, allowing attackers to manipulate the update process. By embedding a certificate from a sibling intermediate authority under the same root, an attacker could potentially create a valid signature for a malicious update, which SWUpdate would then install. This vulnerability exploits the application's handling of certificate chains, bypassing intended security measures.
Users can update to SWUpdate version 2026.05.1 or later, where this vulnerability has been addressed. Instructions for updating can be found in the SWUpdate documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sbabic/swupdate | [email protected] | Vendor |
| https://github.com/sbabic/swupdate/blob/2026.05.1/crypto/swupdate_cms_verify_openssl.c | [email protected] | Source CodeVendor |
| https://github.com/sbabic/swupdate/commit/e66c5640664a31668926a24c0c84b6b6570dc0d9 | [email protected] | Source CodeVendor |
| https://groups.google.com/g/swupdate/c/dsoMcGFnEns | [email protected] | Issue TrackingMailing ListTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/swupdate-through-2026.05.1-cms-signature-verification-bypass-via-embedded-intermediates | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SWUpdate | <= 2026.05.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |