CVE-2026-6899 MEDIUM

CVE-2026-6899: Improper Check for Certificate Revocation in S2OPC

Vendor Systerel

Product S2OPC

Weakness CWE-299

Published June 9, 2026

Last update June 9, 2026

View on NVD All CVEs

CVSS base score

5.6/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in the CycloneCrypto cryptographic wrapper of S2OPC library. It might allow connection between an OPC UA client and server using a revoked certificate.

Key dates

02Disclosure timeline

June 9, 2026 CVE published

June 9, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-6899 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/299.html

Related vulnerabilities

04Related CVE

CVE-2025-36057 IBM Cognos Analytics Mobile (iOS) authentication bypass CVE-2026-4428 CRL Distribution Point Scope Check Logic Error in AWS-LC CVE-2024-56138 Timestamp signature generation lacks certificate revocation check in notion-go CVE-2025-3085 MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revoked CVE-2025-11955 Incorrect validation of OCSP certificates in TheGreenBow VPN Client Windows Enterprise