CVE-2026-60038: OpenSSL command injection in ImportPKCS12
Published Nov 10, 2026
·Updated
A high privileged remote attacker can perform an OpenSSL code injection in the backends ImportPKCS12 function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
Event History
Nov 10, 2026
CVE Published
via MITRE·08:35 AM
Data Sourced
via MITRE·08:35 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker must be remote and already hold high privileges. No user interaction is required, and the attack complexity is rated low.
2
What is the potential impact of successful exploitation?
Successful exploitation can lead to code execution through the ImportPKCS12 backend function. The reported impact is a total loss of confidentiality, integrity, and availability.