CVE-2026-82356
📛 CVE Title
Imprivata EAM: Unrotatable X.509 RSA Key Pair in Production
Description
Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- certcc
- CVSS severity
- —
- CVSS score
- —
- CVSS vector
- —
- Effective score
- no score available from CNA, NVD, or AI yet
- CWE(s)
-
CWE-326 Inadequate Encryption Strength,CWE-327 Use of a Broken or Risky Cryptographic Algorithm - Reserved
- 2026-08-28
- Published
- 2026-09-23 18:25 UTC
- Last updated
- 2026-09-23 19:06 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82356.json
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-09-23 19:19:34 UTC
- NVD last modified
- 2026-09-23 20:17:16 UTC
NVD / KEV / EPSS data refreshed 2026-09-24 04:34 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
AI-forensic CVSS estimate
Used only when a CVE has no official CVSS from its CNA or NVD. An LLM estimates the v3.1 base score from the description; a HIGH/CRITICAL estimate promotes the CVE to a Threat.
No AI estimate yet — it runs automatically once NVD has been checked, or click the button above.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-85537 - Assigner
- certcc
- Published
- Sep 23, 2026, 6:25:22 PM
- Updated
- Sep 23, 2026, 7:06:58 PM
- EUVD base score
- 0.0 / 10
- EUVD-reported EPSS
- 0.0000
- Vendors
- Imprivata
- Products
-
Imprivata Enterprise Access Management (0.0.0 ≤26.2.6)
- Aliases
-
GHSA-7m5x-h6hr-fr53
ENISA description: Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices.
EUVD references (1)
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Imprivata | Imprivata Enterprise Access Management |
0.0.0 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (2)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://kb.cert.org/vuls/id/273940 cret@cert.org
- https://www.kb.cert.org/vuls/id/273940 af854a3a-2127-422b-91ae-364da2661108
Remediations (10)
-
web:app.opencve.io
Remediation No vendor fix or workaround currently provided. OpenCVE Recommended Actions Upgrade Imprivata Enterprise Access Management to the latest release that supports RSA key rotation (26.2.7 or newer).
2026-09-24 11:50 UTC -
web:arcticwolf.com
Validate Group Policy and registry settings for Defender to ensure real-time protection, automatic remediation , and exclusion policies are secured. Temporary Workarounds Block Vulnerable Apps: Use Microsoft Defender Vulnerability Management to block or warn against execution of affected binaries for systems pending a patch .
2026-09-24 11:50 UTC -
web:dailysecurityreview.com
Microsoft confirmed CVE - 2026 -50656, a zero-day in the Defender Malware Protection Engine allowing SYSTEM-level privilege escalation, is under active exploitation with no patch currently available.
2026-09-24 11:50 UTC -
web:senserva.com
Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.
2026-09-24 11:50 UTC -
web:support.microsoft.com
Be aware that the update in the Microsoft Download Center applies to the Microsoft Installer (.msi)-based edition of Office 2016. It doesn't apply to the Office 2016 Click-to-Run editions, such as Microsoft Office 365 Home. (See What version of Office am I using?) How to get and install the update Method 1: Microsoft Update This update is available from Microsoft Update. When you turn on ...
2026-09-24 11:50 UTC -
web:windowsforum.com
ShieldBreak, a newly published proof of concept from the researcher known as Nightmare Eclipse, claims to bypass Microsoft's July fix for the Microsoft Defender privilege-escalation flaw CVE - 2026 -50656, better known as RoguePlanet.
2026-09-24 11:50 UTC -
web:www.aikido.dev
CVE remediation is fixing known flaws in the software you run. Why upgrading often fails, what remediation actually involves, and how backporting fixes it.
2026-09-24 11:50 UTC -
web:www.cisecurity.org
Microsoft reports CVE - 2026 -56164 has been exploited in the wild. CVE - 2026 -56164 may allow remote cyber threat actors to gain unauthorized access to on-premises SharePoint Server instances. Microsoft noted that integrating its Antimalware Scan Interface (AMSI) can provide temporary mitigation by actively scanning and detecting malicious POST requests associated with exploitation attempts. The ...
2026-09-24 11:50 UTC -
web:www.oracle.com
This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.
2026-09-24 11:50 UTC -
web:www.techtimes.com
July 2026 Patch Tuesday permanently removes the Kerberos RC4 rollback registry key on July 14, leaving service accounts with RC4-only material unable to authenticate. Administrators must also ...
2026-09-24 11:50 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-82356.json.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-09-23T19:06:58.517Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.kb.cert.org/vuls/id/273940"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Imprivata Enterprise Access Management",
"vendor": "Imprivata",
"versions": [
{
"lessThanOrEqual": "26.2.6",
"status": "affected",
"version": "0.0.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-326 Inadequate Encryption Strength",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T18:25:22.672Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://kb.cert.org/vuls/id/273940"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Imprivata EAM: Unrotatable X.509 RSA Key Pair in Production",
"x_generator": {
"engine": "VINCE 3.0.49",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-82356"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-82356",
"datePublished": "2026-09-23T18:25:22.672Z",
"dateReserved": "2026-08-28T18:04:06.099Z",
"dateUpdated": "2026-09-23T19:06:58.517Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}