CVE-2026-59642

Estado: AnalizadaAlta (8.7)—

In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
Puntuación base: 8.7

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.30%
Percentil entre todas las CVEs puntuadas: 21
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access75 %
Impacto principalT1565.002 Transmitted Data Manipulationimpact65 %
Impacto secundarioT1552.004 Private Keyscredential access60 %

CMS AuthenticatedData sin vinculación a MAC permite manipulación de contenido (T1565.002) e interceptación de credenciales/datos sensibles (T1552.004) vía aplicación Java expuesta en red (CVSS AV:N, VI:H, CWE-354 validación deficiente).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Encrypt Sensitive Information Vulnerability Scanning Restrict File and Directory Permissions Privileged Account Management Password Policies Network Segmentation

Tecnologías afectadas (3)

Bouncycastle — Bc-java Bouncycastle — Bcpkix-fips Bouncycastle — Bouncy Castle FOR Java LTS

CWE

CWE-354

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-59642",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-59642",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-03T13:27:10.316195Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "91579145-5d7b-4cc5-b925-a0262ff19630",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.7,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "AMBER",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "91579145-5d7b-4cc5-b925-a0262ff19630",
      "affectedData": [
        {
          "repo": "https://github.com/bcgit/bc-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "modules": [
            "pkix"
          ],
          "product": "BC-JAVA",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.85",
              "versionType": "maven"
            }
          ],
          "platforms": [
            "all"
          ],
          "packageURL": "pkg:maven/org.bouncycastle/bcpkix-jdk18on",
          "packageName": "bcpkix",
          "programFiles": [
            "RecipientInformation"
          ],
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://github.com/bcgit/bc-lts-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "modules": [
            "pkix"
          ],
          "product": "BC-LTS-JAVA",
          "versions": [
            {
              "status": "affected",
              "version": "2.73.0",
              "lessThan": "2.73.12",
              "versionType": "maven"
            }
          ],
          "platforms": [
            "all"
          ],
          "packageURL": "pkg:maven/org.bouncycastle/bcpkix-lts8on",
          "packageName": "bcpkix-lts8on",
          "programFiles": [
            "RecipientInformation"
          ],
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Legion of the Bouncy Castle Inc.",
          "product": "BC-FJA",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "1.0.12",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "2.0.0",
              "lessThan": "2.0.12",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "2.1.0",
              "lessThan": "2.1.12",
              "versionType": "maven"
            }
          ],
          "platforms": [
            "all"
          ],
          "packageURL": "pkg:maven/org.bouncycastle/bcpkix-fips",
          "packageName": "bcpkix-fips",
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-08-03T01:16:44.203",
  "references": [
    {
      "url": "https://github.com/bcgit/bc-java/commit/2117f316a5a47308f3e569695a6592b16aac0dd7",
      "tags": [
        "Patch"
      ],
      "source": "91579145-5d7b-4cc5-b925-a0262ff19630"
    },
    {
      "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059642",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "91579145-5d7b-4cc5-b925-a0262ff19630"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "91579145-5d7b-4cc5-b925-a0262ff19630",
      "description": [
        {
          "lang": "en",
          "value": "CWE-354"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series)."
    }
  ],
  "lastModified": "2026-08-28T18:12:17.230",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA6A5663-2E62-44AA-8A64-A3CB0DC8813B",
              "versionEndExcluding": "1.85"
            },
            {
              "criteria": "cpe:2.3:a:bouncycastle:bcpkix-fips:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C878934F-879A-4F9A-B81C-C284BF7797D4",
              "versionEndExcluding": "1.0.12"
            },
            {
              "criteria": "cpe:2.3:a:bouncycastle:bcpkix-fips:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D0FF4FC3-75CF-4C5C-AEF1-342B8123264B",
              "versionEndExcluding": "2.0.12",
              "versionStartIncluding": "2.0.7"
            },
            {
              "criteria": "cpe:2.3:a:bouncycastle:bcpkix-fips:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5C3EAC6-7756-48AC-9129-A9BE7E11A8C7",
              "versionEndExcluding": "2.1.12",
              "versionStartIncluding": "2.1.8"
            },
            {
              "criteria": "cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5ED4F42-08FF-4642-815D-1ED0C82FDBD2",
              "versionEndIncluding": "2.73.11"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "91579145-5d7b-4cc5-b925-a0262ff19630"
}