Priority MEDIUM 47
In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption…
med-united
Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
med-united records in CISA KEVNo med-united vulnerabilities are listed in CISA KEV.
Records
2 records
TI-2026-39236 CVE-2026-54342
TLS Certificate Verification Disabled on CXF Transport Clients in epa4all
Priority LOW 37
In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Aktensystem, Konnektor, IDP, TSS) can present a self-signed TLS certificate and intercept the connection.