CLEANSTART-2026-XF95731: In Bouncy Castle for Java before 1

Q: Which deployments should be prioritized for investigation?

The advisory identifies cleanstart/wso2am, cleanstart/rundeck, and cleanstart/wso2mi as affected software. The issue concerns Bouncy Castle for Java, but the affected version boundary is incomplete in the available data.

Q: Does exploitation require network access or prior authentication?

The provided vector indicates local attack access, no privileges required, no user interaction, high attack complexity, and an additional attack requirement. It does not indicate a network-reachable exploitation path.

Q: What is the stated security impact?

The vector indicates high impact to confidentiality, with no stated impact to integrity or availability. The overall severity is medium, scored 5.9.

Published Nov 13, 2026

Updated

CVE-2026-18040 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details.

Affected Software

3 affected componentsFixes available

cleanstart/wso2am<4.7.0-r5

4.7.0-r5

cleanstart/rundeck<6.0.1-r11

6.0.1-r11

cleanstart/wso2mi<4.6.0-r9

4.6.0-r9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/wso2am to a version that resolves this vulnerability.
Fixed in 4.7.0-r5
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.0.1-r11
Upgrade
Upgrade cleanstart/wso2mi to a version that resolves this vulnerability.
Fixed in 4.6.0-r9

Event History

Nov 13, 2026

Advisory Published

via OSV·12:36 AM

Data Sourced

via OSV·12:36 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-18040

Frequently Asked Questions

Which deployments should be prioritized for investigation?