CVE-2026-1814: Rapid7 Nexpose Insecure Java Keystore Password Generation
Published Feb 3, 2026
·Updated
A security vulnerability has been identified in Rapid7 Nexpose. Remediation is in progress.
Affected Software
1 affected component
Rapid7 Nexpose
Remediation
Information
InsightVM or Nexpose customers with automatic product updates enabled will receive and process this update when it is released. Customers who manually control their own update version can utilize the manual update process within the security console to update to version 8.36.0 when it is made available. We recommend those customers schedule this update as soon as reasonably possible.
Event History
Feb 3, 2026
CVE Published
via MITRE·02:54 PM
Data Sourced
via MITRE·02:54 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-1814?
CVE-2026-1814 is classified as a medium severity vulnerability due to the insufficient entropy in password generation.
2
How do I fix CVE-2026-1814?
To fix CVE-2026-1814, update Rapid7 Nexpose to a version later than 6.4.50 where the password generation issue is resolved.
3
What versions of Rapid7 Nexpose are affected by CVE-2026-1814?
Rapid7 Nexpose versions 6.4.50 and later are affected by CVE-2026-1814.
4
What impact does CVE-2026-1814 have on security?
CVE-2026-1814 may allow attackers to predict or compromise keystore passwords due to the low entropy in generated passwords.
5
Is there a workaround for CVE-2026-1814?
No official workaround is available for CVE-2026-1814; upgrading to a secure version is the recommended mitigation.