CVE-2026-86231

Received Received - Intake

Certificate Revocation Bypass in jsch

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: VulDB

Description

A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate revocation. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.28.6 is able to address this issue. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. You should upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-06

Last Modified

2026-09-06

Generated

2026-09-07

AI Q&A

2026-09-07

EPSS Evaluated

N/A

NVD

CVE-2026-86231

EUVD

EUVD-2026-72179

Affected Vendors & Products

Vendor	Product	Version / Range
mwiede	jsch	to 2.28.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-298	A certificate expiration is not validated or is incorrectly validated, so trust may be assigned to certificates that have been abandoned due to age.
CWE-299	The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.

Attack-Flow Graph

Executive Summary

This vulnerability is a security flaw in mwiede jsch versions up to 2.28.5. It exists in the getRevokedKeys function of the KnownHosts.java file. The issue allows improper certificate revocation checks when the known_hosts argument is manipulated. The attack can be executed remotely but requires high complexity and is considered difficult to exploit. A public exploit is available, and upgrading to version 2.28.6 fixes the problem.

Detection Guidance

This vulnerability affects mwiede jsch versions up to 2.28.5. Detection involves checking the installed version of the library. Use commands like 'find / -name jsch*.jar' to locate the library and 'java -jar <path-to-jsch.jar> -version' to check its version. If the version is 2.28.5 or lower, the system is vulnerable.

Impact Analysis

This vulnerability could allow attackers to bypass certificate revocation checks, potentially leading to unauthorized access or man-in-the-middle attacks. Since the exploit is public and remotely executable, systems using vulnerable versions of mwiede jsch may be at risk of security breaches if not patched.

Compliance Impact

This vulnerability may lead to improper certificate revocation checks, potentially allowing unauthorized access. While not directly tied to GDPR or HIPAA, such flaws could compromise data integrity and confidentiality, indirectly impacting compliance if exploited.

Mitigation Strategies

Upgrade the affected component mwiede jsch to version 2.28.6 or later to address the vulnerability. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23.

Hi! I’m here to help you understand CVE-2026-86231. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70