CVE-2026-121624: Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation

Published Nov 3, 2026

Updated

Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes.

Event History

Nov 3, 2026

CVE Published

via MITRE·05:13 PM

Data Sourced

via MITRE·05:13 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Windows and macOS systems running Nanosystems Supremo versions earlier than 5.0.2.3874 are affected when an attacker is on the same network and can intercept the client’s TLS traffic.

What does an attacker need to exploit it?

The attacker needs adjacent-network access and the ability to intercept the TLS connection. No privileges or user interaction are required, but exploitation has high attack complexity.

What information can be exposed during an attack?

An attacker can use a self-signed certificate to terminate and relay the TLS session, allowing them to read usernames, SHA-256 password hashes, and license codes.

What version resolves the issue?

Upgrade Supremo to version 5.0.2.3874 or later on Windows and macOS.

CVE-2026-121624: Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What information can be exposed during an attack?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What information can be exposed during an attack?

What version resolves the issue?