CVE-2026-82356 Imprivata EAM: Unrotatable X.509 RSA Key Pair in Production
Imprivata EAM fails to support RSA key rotation for X.509 certificates, violating cryptographic best practices and potentially weakening long-term security.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82356?
CVE-2026-82356 is a high-severity vulnerability in Imprivata Enterprise Access Management, published on 23 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices.
Which versions are affected by CVE-2026-82356?
How do I fix CVE-2026-82356?
No fix has been published for CVE-2026-82356 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-82356 being exploited?
There is no known exploitation of CVE-2026-82356 in the wild and no public exploit code.
Sources
Also known as GHSA-7m5x-h6hr-fr53.