Insufficient verification of data authenticity in cryptography - CVE-2026-26007

Vulnerability identifier: #VU124874

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-26007

CWE-ID: CWE-345

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. A remote attacker can provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup.

cryptography
Storage Sentinel Anomaly Scan Engine
Storage Defender - Resiliency Service
Oracle Communications Operations Monitor
SOAR QRadar Plugin App
Storage Protect Plus File Systems Agent
Storage Protect Plus Guest Applications
QRadar App SDK
Storage Protect Plus Server
IBM Cloud Pak for Data System
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Maximo Application Suite
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Repository Function
IBM Cloud Object Storage Systems
App Connect Enterprise Certified Container
Communications Unified Assurance
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Ubuntu
Anolis OS
openEuler
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
python-cryptography (Ubuntu package)
fence-agents (Red Hat package)
python-cryptography-debugsource
python-cryptography
python-cryptography-debuginfo
python3-cryptography
python-cryptography-help
Oracle Database Server
Oracle Communications Cloud Native Core Service Communication Proxy
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Security Edge Protection Proxy
IBM Security SOAR

Install updates from vendor's website.

cryptography - update to 46.0.5
IBM Cloud Pak for Data System - update to 8.10.26.06.SP2
Storage Sentinel Anomaly Scan Engine - update to 2.3.0
Storage Defender - Resiliency Service - update to 2.1.3
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.3.1 Patch 2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.1
SOAR QRadar Plugin App - update to 5.6.4
IBM Maximo Application Suite - addressed in versions 8.10.36, 8.11.33, 9.0.22, 9.1.11
Storage Protect Plus File Systems Agent - update to 10.1.19
Storage Protect Plus Guest Applications - update to 10.1.19
IBM Security SOAR - update to 51.0.9.2
python-cryptography (Ubuntu package) - addressed in versions 1.2.3-1ubuntu0.3+esm3, 2.1.4-1ubuntu1.4+esm3, 2.8-3ubuntu0.3+esm2, 3.4.8-1ubuntu2.3, 41.0.7-4ubuntu0.3, 43.0.0-1ubuntu1.1
QRadar App SDK - update to 2.2.5
IBM Cloud Object Storage Systems - addressed in versions 3.20.0.43, 3.20.0.69
fence-agents (Red Hat package) - addressed in versions 4.2.1-129.el8_10.25, 4.10.0-43.el9_2.21, 4.10.0-62.el9_4.24, 4.10.0-98.el9_7.12
Storage Protect Plus Server - update to 10.1.18
App Connect Enterprise Certified Container - addressed in versions 12.0.22, 13.0.0
python-cryptography-debugsource - update to 42.0.2-9
python-cryptography - update to 42.0.2-9
python-cryptography-debuginfo - update to 42.0.2-9
python3-cryptography - update to 42.0.2-9
python-cryptography-help - update to 42.0.2-9
python3-cryptography - update to 42.0.5-3

• https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c
• https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2
• http://www.openwall.com/lists/oss-security/2026/02/10/4

• Insufficient verification of data authenticity in cryptography
• Multiple vulnerabilities in IBM Storage Protect Plus Server
• openEuler 24.03 LTS SP3 update for python-cryptography
• openEuler 24.03 LTS SP2 update for python-cryptography
• openEuler 24.03 LTS SP1 update for python-cryptography
• openEuler 24.03 LTS update for python-cryptography
• Anolis OS update for python-cryptography
• Multiple vulnerabilities in IBM Maximo Application Suite
• Ubuntu update for python-cryptography
• Multiple vulnerabilities in IBM Storage Sentinel Anomaly Scan Engine
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge
• IBM App Connect Enterprise Certified Container DesignerAuthoring and Dashboard operands update for cryptography
• IBM SOAR QRadar Plugin App update for cryptography package
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service
• Multiple vulnerabilities in Oracle Database Server
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Service Communication Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Operations Monitor
• Multiple vulnerabilities in Communications Unified Assurance
• IBM Security SOAR update for cryptography
• Ubuntu update for python-cryptography
• Red Hat Enterprise Linux 8 update for fence-agents
• IBM Watson Discovery Cartridge update for cryptography
• Red Hat Enterprise Linux 9 update for fence-agents
• Multiple vulnerabilities in IBM Cloud Object System
• Red Hat Enterprise Linux 9 update for fence-agents
• Red Hat Enterprise Linux 9 update for fence-agents
• Multiple vulnerabilities in IBM QRadar App SDK
• Multiple vulnerabilities in IBM Cloud Pak for Data System
• Multiple vulnerabilities in IBM Storage Protect Plus