CVE-2026-6899

MediumCVSS 5.6/10Last modified Jul 23, 2026

Description

Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in the CycloneCrypto cryptographic wrapper of S2OPC library. It might allow connection between an OPC UA client and server using a revoked certificate.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-299

Affected software

Vendor	Product	Versions
Systerel	S2OPC	>= 1.5.0, < 1.7.3

References

https://gitlab.com/systerel/S2OPC/-/work_items/1739

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-689907.8In the Samsung Exynos H-Arx DRM plugin, improper input validation during buffer operations can cause memory corruption, potentially leading CVE-2026-689919.8In the Samsung Exynos ENN NeuralNetworks HAL, improper input validation during request processing can cause memory corruption and lead to a CVE-2026-689936.3A double free vulnerability in NPU driver due to improper pointer management (940)CVE-2026-689947.3A double free vulnerability in NPU driver due to improper pointer management (941)CVE-2026-69007.4Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5.CVE-2026-690027.5Incorrect authorization in Samsung framework services due to missing permission checks CVE-2026-690057.3Integer overflow in NPU driver parameter processing due to insufficient bounds checking.CVE-2026-690069.1Insufficient validation of length fields in the GNSS firmware loader can result in kernel‑memory corruption.CVE-2026-69017.7Untrusted Search Path vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5.CVE-2026-69027.7A Remote Code Execution vulnerability in P4 (Helix Core) Server's Command-Line Client, prior to the 2025.2 Patch 2, has been fixed to addres CVE-2026-690257.5In the Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial o CVE-2026-69037.5The LabOne Web Server, backing the LabOne User Interface, contains insufficient input validation in its file access functionality. An unauth