CVE-2026-109399 SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates
Attackers can bypass signature verification in SWUpdate to install malicious firmware updates by embedding untrusted intermediate certificates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-109399?
CVE-2026-109399 is a critical vulnerability in sbabic swupdate, published on 12 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can embed that intermediate in the signature to install malicious updates.
Weakness: CWE-295
Which versions are affected by CVE-2026-109399?
How do I fix CVE-2026-109399?
Apply the vendor's patch.
Is CVE-2026-109399 being exploited?
There is no known exploitation of CVE-2026-109399 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-109399, GHSA-xf8v-f779-856c, UBUNTU-CVE-2026-109399.