PT-2026-47721 · S2Opc · S2Opc

Systerel · Published 2026-06-09 · Updated 2026-06-09 · CVE-2026-6899

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions S2OPC library (affected versions not specified)

Description The CycloneCrypto cryptographic wrapper within the S2OPC library contains a flaw where certificate revocation checks only consider the first matching Certificate Revocation List (CRL) and ignore other valid CRLs from the same Certificate Authority (CA). This behavior could allow an OPC UA client and server to establish a connection using a revoked certificate.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-299

Related Identifiers

CVE-2026-6899

Affected Products

S2Opc

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-6899 · Security Note
• https://twitter.com/VulmonFeeds/status/2064290150335611317 · Twitter Post
• https://gitlab.com/systerel/S2OPC/-/work_items/1739 · Note