CVE-2026-82356CWE-326CWE-327

CVE-2026-82356

High · published September 23, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
1.2
In the wild
Unconfirmed
What it is

Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00110 · 1.2th percentile
Weaknesses
CWE-326 · Inadequate Encryption Strength; CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
Published
2026-09-23T23:19Z
References (2)
https://kb.cert.org/vuls/id/273940 · [email protected]https://www.kb.cert.org/vuls/id/273940 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 23 SEP 18:25Z
    Imprivata EAM: Unrotatable X.509 RSA Key Pair in Production
    cvelistv5