CVE-2026-88648

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-11-04

Assigner: MITRE

Description

In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-11-04

Generated

2026-11-08

AI Q&A

2026-10-08

EPSS Evaluated

2026-11-07

NVD

CVE-2026-88648

EUVD

EUVD-2026-95205

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

This vulnerability is in GnuTLS v3.8.13 due to incomplete X.509 implementation. Attackers who control a subordinate Certificate Authority can bypass PKI restrictions and issue unauthorized certificates across domains.

Detection Guidance

To detect this vulnerability, check the GnuTLS version on your system using 'gnutls-cli --version' or 'dpkg -l | grep gnutls'. If version 3.8.13 is installed, the system is vulnerable. Review certificate chains for improperly issued certificates by examining logs or using OpenSSL commands like 'openssl verify -CAfile chain.pem cert.pem'.

Impact Analysis

If exploited, this flaw could allow attackers to impersonate legitimate services or users, leading to data breaches, unauthorized access, or man-in-the-middle attacks.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data, potentially leading to legal penalties under GDPR or HIPAA.

Mitigation Strategies

Immediately upgrade GnuTLS to a patched version if available. Disable subordinate CAs with weak validation policies. Monitor certificate issuance logs for unauthorized certificates. Temporarily enforce stricter PKI restrictions until patches are applied.

Hi! I’m here to help you understand CVE-2026-88648. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...