{"id":"CVE-2026-117611","aliases":[],"cve":{"records":[{"id":"CVE-2026-117611","source":"Checkmk","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-27T13:09:00.724Z","published":"2026-10-29T09:32:57.964Z","modified":"2026-10-29T14:13:09.797Z"}],"publishers":[{"name":"Checkmk","role":"CNA","organizationId":"f7d6281c-4801-44ce-ace2-493291dedb0f","modified":"2026-10-29T09:32:57.964Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T14:13:09.797Z"}],"references":[{"url":"https://checkmk.com/werk/22623","tags":["vendor-advisory"],"source":"Checkmk"},{"url":"https://checkmk.com/werk/22169","tags":["vendor-advisory"],"source":"Checkmk"},{"url":"https://github.com/advisories/GHSA-6q48-6c7w-9gw2","tags":["third-party-advisory"],"source":"Checkmk"}],"weaknesses":[{"id":"CWE-295","description":"CWE-295: Improper Certificate Validation","source":"Checkmk"},{"id":"CWE-1395","description":"CWE-1395: Dependency on Vulnerable Third-Party Component","source":"Checkmk"}],"applicability":[{"source":"Checkmk","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*","versionStartIncluding":"2.5.0","versionEndExcluding":"2.5.0p18"},{"vulnerable":true,"criteria":"cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*","versionStartIncluding":"2.4.0","versionEndExcluding":"2.4.0p39"},{"vulnerable":true,"criteria":"cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*","versionStartIncluding":"2.3.0","versionEndExcluding":"2.3.0p52"},{"vulnerable":true,"criteria":"cpe:2.3:a:checkmk:checkmk:2.2.0:*:*:*:*:*:*:*"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T14:12:49.762481Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Trust of compromised eMudhra root CA in bundled CA stores","titleSource":"Checkmk","descriptionSource":"Checkmk","description":"Improper certificate validation in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL): the Certificate Authority stores bundled with \"certifi\" and \"webpki-roots\" include a root CA that trusts eMudhra (emSign) intermediate certificates whose private keys are public.","score":7.1,"severity":"high","published":"2026-10-29T09:32:57.964Z","modified":"2026-10-29T14:13:09.797Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Checkmk GmbH","name":"Checkmk","platforms":[],"versions":[{"version":"2.5.0","status":"affected","lessThan":"2.5.0p18","versionType":"semver"},{"version":"2.4.0","status":"affected","lessThan":"2.4.0p39","versionType":"semver"},{"version":"2.3.0","status":"affected","lessThan":"2.3.0p52","versionType":"semver"},{"version":"2.2.0","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"Checkmk","url":"https://www.cve.org/CVERecord?id=CVE-2026-117611"}],"remediation":[],"references":["https://checkmk.com/werk/22623","https://checkmk.com/werk/22169","https://github.com/advisories/GHSA-6q48-6c7w-9gw2"],"sources":[{"name":"CVE","id":"CVE-2026-117611","modified":"2026-10-29T14:13:09.797Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-117611"}],"assessments":[{"source":"Checkmk","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H","score":7.1}],"sourceAffected":[],"observedAt":"2026-10-29T14:28:11.151Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T01:05:34.749Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-29T09:45:32.753Z","attemptedAt":"2026-10-29T09:45:32.753Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-29T09:45:32.753Z","attemptedAt":"2026-10-29T09:45:32.753Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-29T09:45:32.753Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T09:45:32.753Z","attemptedAt":"2026-10-29T09:45:32.753Z"}],"evidence":[],"aiSummary":null}