CVE-2026-82356

Awaiting Analysis Awaiting Analysis - Queue

Imprivata EAM RSA Key Pair Certificate Generation Vulnerability

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: CERT/CC

Description

Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-10-14

AI Q&A

2026-09-23

EPSS Evaluated

2026-10-12

NVD

CVE-2026-82356

EUVD

EUVD-2026-85537

Affected Vendors & Products

Vendor	Product	Version / Range
imprivata	eam	to 26.2.6 (inc)
imprivata	enterprise_access_management	to 26.2.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-327	The product uses a broken or risky cryptographic algorithm or protocol.
CWE-326	The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Attack-Flow Graph

Executive Summary

Imprivata EAM versions 26.2.6 and below have a flaw where the RSA key pair used for generating X.509 certificates cannot be rotated after deployment. This means the same key pair is used indefinitely, which violates security best practices.

Detection Guidance

To detect this vulnerability, check if your Imprivata EAM appliance is running version 26.2.6 or below. Verify if the RSA key pair used for X.509 certificate generation has been in use since deployment without rotation. Inspect system logs for any unusual authentication traffic or SSO token interception attempts.

Impact Analysis

Using a static RSA key pair for certificate generation increases the risk of key compromise. If the key is exposed, attackers could impersonate the system, decrypt communications, or forge certificates, leading to potential data breaches or unauthorized access.

Compliance Impact

This vulnerability may violate compliance requirements that mandate regular cryptographic key rotation, such as NIST guidelines or industry-specific regulations like GDPR (data protection) and HIPAA (healthcare data). Failure to rotate keys could result in non-compliance penalties.

Mitigation Strategies

Rotate the RSA key pair used by Imprivata EAM to comply with best practices. Check the documentation for key rotation procedures and update to a version that supports automatic key rotation if available.

Hi! I’m here to help you understand CVE-2026-82356. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70