Improper Validity Period Check in CycloneCrypto S2OPC

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: GitLab Inc.

Description

Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-18257

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in the CycloneCrypto cryptographic wrapper of S2OPC where the validity period of a root issuer certificate is not properly checked. As a result, certificates issued by this root issuer are incorrectly considered trusted, potentially allowing unauthorized access or actions.

Impact Analysis

This vulnerability could allow attackers to bypass security checks by presenting a certificate that should not be trusted. This may lead to unauthorized access to systems, data breaches, or other malicious activities depending on the affected system's use of the S2OPC software.

Hi! I’m here to help you understand CVE-2026-18257. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70