CVE-2026-6899

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6899", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-04-23T07:01:03.918Z", "datePublished": "2026-06-09T08:39:00.495Z", "dateUpdated": "2026-06-09T14:25:59.888Z"}, "containers": {"cna": {"title": "Improper Check for Certificate Revocation in S2OPC", "descriptions": [{"lang": "en", "value": "Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in the CycloneCrypto cryptographic wrapper of S2OPC library. It might allow connection between an OPC UA client and server using a revoked certificate."}], "affected": [{"vendor": "Systerel", "product": "S2OPC", "versions": [{"version": "1.5.0", "status": "affected", "lessThan": "1.7.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-299: Improper Check for Certificate Revocation", "cweId": "CWE-299", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/systerel/S2OPC/-/work_items/1739"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Use MbedTLS cryptographic wrapper, or upgrade S2OPC to commit 3ff81301d95a77260e9deb791585a620c5623028 or release version > 1.7.2"}], "credits": [{"lang": "en", "value": "Systerel", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-06-09T08:39:00.495Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-09T14:25:36.868407Z", "id": "CVE-2026-6899", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T14:25:59.888Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6899", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T14:25:36.868407Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T14:25:52.844Z"}}], "cna": {"title": "Improper Check for Certificate Revocation in S2OPC", "credits": [{"lang": "en", "type": "finder", "value": "Systerel"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Systerel", "product": "S2OPC", "versions": [{"status": "affected", "version": "1.5.0", "lessThan": "1.7.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Use MbedTLS cryptographic wrapper, or upgrade S2OPC to commit 3ff81301d95a77260e9deb791585a620c5623028 or release version > 1.7.2"}], "references": [{"url": "https://gitlab.com/systerel/S2OPC/-/work_items/1739"}], "descriptions": [{"lang": "en", "value": "Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in the CycloneCrypto cryptographic wrapper of S2OPC library. It might allow connection between an OPC UA client and server using a revoked certificate."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-299", "description": "CWE-299: Improper Check for Certificate Revocation"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-06-09T08:39:00.495Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6899", "state": "PUBLISHED", "dateUpdated": "2026-06-09T14:25:59.888Z", "dateReserved": "2026-04-23T07:01:03.918Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2026-06-09T08:39:00.495Z", "assignerShortName": "GitLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "S2OPC", "vendor": "Systerel", "versions": [{"lessThan": "1.7.3", "status": "affected", "version": "1.5.0", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in the CycloneCrypto cryptographic wrapper of S2OPC library. It might allow connection between an OPC UA client and server using a revoked certificate."}, {"lang": "es", "value": "La verificaci\u00f3n de revocaci\u00f3n de certificados solo considera la primera CRL coincidente e ignora otras CRL v\u00e1lidas de la misma CA en el envoltorio criptogr\u00e1fico CycloneCrypto de la biblioteca S2OPC. Podr\u00eda permitir la conexi\u00f3n entre un cliente OPC UA y un servidor utilizando un certificado revocado."}], "id": "CVE-2026-6899", "lastModified": "2026-07-23T08:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.4, "source": "cve@gitlab.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6899", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-09T14:25:36.868407Z", "version": "2.0.3"}}]}, "published": "2026-06-09T09:16:30.737", "references": [{"source": "cve@gitlab.com", "url": "https://gitlab.com/systerel/S2OPC/-/work_items/1739"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-299"}], "source": "cve@gitlab.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.5.0,1.7.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "S2OPC", "source": "cna", "vendor": "Systerel"}, "product": "s2opc", "vendor": "systerel"}], "created": "2026-06-09T09:56:56.427376+00:00", "updated": "2026-06-09T10:00:07.156142+00:00", "vendors": ["systerel", "systerel$PRODUCT$s2opc"]}