High 8.7Published Oct 2, 2026

CVE-2026-63571Attribute certificate path validation does not verify the attribute certificate's signature

Updated under an hour ago (2026-10-19 07:00 UTC)

Does this affect you?

It affects Legion of the Bouncy Castle Inc. bc-csharp. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.17%, higher than 6% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Legion of the Bouncy Castle Inc. bc-csharp

Exploited in the last 30 days

Improper verification of cryptographic signature in the attribute certificate path validator (PkixAttrCertPathValidator, also used by PkixAttrCertPathBuilder) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to have a forged X.509 attribute certificate accepted as valid, and so obtain whatever roles or privileges an application grants on the strength of its attributes, via an attribute certificate that names a trusted attribute authority as its issuer but was not signed by it, because the RFC 3281 validation steps check the holder and issuer certification paths, validity period, extensions and revocation status but never verify the attribute certificate's signature with the issuer's public key. Only applications that use these classes to validate attribute certificates are affected.

CVSS: 8.7 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-347
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.17% (percentile 6)
Assigned by: bcorg
NVD analysis: Undergoing Analysis
Record last updated: Oct 2, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Legion of the Bouncy Castle Inc. bc-csharp legion_of_the_bouncy_castle:bc_csharp (from the name)	before 2.7.0	CNA record

References

https://github.com/bcgit/bc-csharp/wiki/CVE-2026-63571vendor-advisory
https://github.com/bcgit/bc-csharp/commit/c08f65e1ed7b92a10776220ed9c047f47c264725patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.