SECUFOCUSNOW
Home›CVE index›CVE-2026-28387
Review reviewHigh

CVE-2026-28387

OpenSSL OpenSSL, SIMATIC CN 4100, SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage. By far the most common deployment of DANE is in SMTP MTAs...

CVSS
8.1
EPSS
0.80%
53.2% percentile
CISA KEV
Not listed
Published
2026.04.08
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.80%
Technical severityCVSS 8.1

Vulnerability overview

Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage. By far the most common deployment of DANE is in SMTP MTAs...

Affected product and versions

Product
OpenSSL OpenSSL, SIMATIC CN 4100, SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
Affected versions
>= 3.6.0 < 3.6.2, >= 3.5.0 < 3.5.6, >= 3.4.0 < 3.4.5, >= 3.3.0 < 3.3.7, >= 3.0.0 < 3.0.20, >= 1.1.1 < 1.1.1zg, < V5.0
Fixed versions
1.1.1zg, 3.0.20, 3.3.7, 3.4.5, 3.5.6, 3.6.2

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that OpenSSL OpenSSL, SIMATIC CN 4100, SIMATIC S7-1500 TM MFP - GNU/Linux subsystem and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416