CVE-2026-81686Medium· 6.2▾ Sunlitopenssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call S…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
0.1% → 0.1%
Last analysed / modified upstream
5.5 → 6.2
openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations (to 0/negative, causing the concurrency gate to refuse all subsequent operations, or to a huge value removing the limit) or the unbounded DefaultTimeout, resulting in a persistent denial of service of the root daemon. The D-Bus service exists only on the 1.4.x line and was removed in 1.5.x.
openssl_encrypt < 1.4.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
openssl-encrypt < 1.4.9Patched in:
openssl-encrypt 1.4.9Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-81707Critical· 9.8openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users
CVE-2026-74870Low· 3.3openssl_encrypt before 1.4.8 Hardware Pepper Information Disclosure
CVE-2026-81680Medium· 4.0openssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal
CVE-2026-81689High· 7.5openssl_encrypt before 1.4.9 Weak Pepper Key Derivation
CVE-2026-81694Low· 3.3verify-usb before 1.4.9 Output Injection via Unsanitized Filenames
CVE-2026-81702Critical· 9.8openssl_encrypt before 1.4.9 Key Substitution via Identity Load