Improper Check for Certificate Revocation in S2OPC
CVE-2026-6899

5.6MEDIUM

Key Information:

Vendor

Systerel

Status
S2opc
Vendor
CVE Published:
9 June 2026

What is CVE-2026-6899?

Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in the CycloneCrypto cryptographic wrapper of S2OPC library. It might allow connection between an OPC UA client and server using a revoked certificate.

Affected Version(s)

S2OPC 1.5.0 < 1.7.3

References

https://gitlab.com/systerel/S2OPC/-/work_items/1739

CVSS V3.1

Score:
5.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Systerel
.