CLEANSTART-2026-JR22326: In Bouncy Castle for Java before 1
CVE-2026-18036 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/wso2amto a version that resolves this vulnerability.Fixed in 4.7.0-r5 - Upgrade
Upgrade
cleanstart/rundeckto a version that resolves this vulnerability.Fixed in 6.0.1-r11 - Upgrade
Upgrade
cleanstart/wso2mito a version that resolves this vulnerability.Fixed in 4.6.0-r9
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
The affected software list includes cleanstart/wso2am, cleanstart/rundeck, and cleanstart/wso2mi. Review instances of these products that include Bouncy Castle for Java.
Does exploitation require authentication or user interaction?
The supplied vector indicates no privileges are required and no user interaction is required. It also indicates network attack access and that additional attack requirements are present, with high attack complexity.
What is the expected security impact if exploited?
The supplied severity vector indicates a high impact on confidentiality. It does not indicate integrity or availability impact, either for the vulnerable component or subsequent systems.