PT-2026-1851 · Neuvector+1 · Neuvector+1

Published 2025-12-12 · Updated 2026-01-08 · CVE-2025-66001

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NeuVector (affected versions not specified)

Description NeuVector supports login authentication through OpenID Connect. The TLS verification, which confirms the remote server’s authenticity and integrity, is not enforced by default for OpenID Connect. This could expose the system to man-in-the-middle (MITM) attacks. A man-in-the-middle attack involves an attacker intercepting communication between two parties without their knowledge.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2025-66001

GHSA-4JJ9-CGQC-X9H5

GO-2025-4235

SUSE-SU-2026:0037-1

Affected Products

Neuvector

Openconnect

References · 88

• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66001 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4jj9-cgqc-x9h5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66001 · Security Note
• https://github.com/neuvector/neuvector/security/advisories/GHSA-4jj9-cgqc-x9h5 · Note
• https://github.com/neuvector/neuvector/commit/955904b5762f296d209bf395a5fcc7a40a53c424 · Note
• https://github.com/neuvector/neuvector · Note
• https://suse.com/security/cve/CVE-2025-8110 · Note
• https://suse.com/security/cve/CVE-2025-54410 · Note
• https://suse.com/security/cve/CVE-2025-65754 · Note
• https://suse.com/security/cve/CVE-2025-66565 · Note
• https://suse.com/security/cve/CVE-2025-68940 · Note
• https://suse.com/security/cve/CVE-2025-67717 · Note
• https://suse.com/security/cve/CVE-2025-68113 · Note
• https://suse.com/support/update/announcement/2026/suse-su-20260037-1 · Note