CVE-2026-18257 Improper Certificate Validation in S2OPC
Attackers can bypass certificate validation in S2OPC by exploiting improper root issuer validity checks, allowing untrusted certificates to be accepted.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-18257?
CVE-2026-18257 is a medium-severity vulnerability in Systerel S2OPC, published on 29 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted
Weakness: CWE-295
Which versions are affected by CVE-2026-18257?
How do I fix CVE-2026-18257?
No fix has been published for CVE-2026-18257 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-18257 being exploited?
There is no known exploitation of CVE-2026-18257 in the wild and no public exploit code.
Sources
Also known as GHSA-xph3-r29g-fwfg.