Read the docs
TI-2026-39236 Aliases CVE-2026-54342

TLS Certificate Verification Disabled on CXF Transport Clients in epa4all

Priority LOW 37CWE-295Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Aktensystem, Konnektor, IDP, TSS) can present a self-signed TLS certificate and intercept the connection. For non-VAU connections (Konnektor, IDP), this allows direct read and modification of the inner traffic, including smartcard operations and OIDC authentication exchanges. For the ePA backend, the disabled TLS verification is the transport-level enabler for the VAU MITM described in GHSA-vvh7-x6c7-46gh. This issue has been patched in version 2026-05-20.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00197 9th percentileScored 2026-11-07
Fix Fixed epa4all (med-united): 2026-05-20

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
med-unitedepa4allbefore 2026-05-202026-05-20Patch availableCNA
  • epa4all Vendormed-united Affected before 2026-05-20 Fixed in 2026-05-20 Patch available CNA

Remediation

  • Fix · CNA epa4all (med-united) Fixed in 2026-05-20

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54342

References

Other 4

  • TI-2026-35465 Improper certificate validation in med-united epa4all CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences