CVE-2026-6899: Improper Check for Certificate Revocation in S2OPC

Published Jun 9, 2026

Updated

Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in the CycloneCrypto cryptographic wrapper of S2OPC library. It might allow connection between an OPC UA client and server using a revoked certificate.

Affected Software

1 affected component

Systerel S2OPC

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade S2OPC to a version that resolves this vulnerability.
Patch 3ff81301d95a77260e9deb791585a620c5623028
Upgrade
Upgrade S2OPC to a version that resolves this vulnerability.
Fixed in > 1.7.2
Configuration
Configure S2OPC to use the MbedTLS cryptographic wrapper instead of the CycloneCrypto wrapper to avoid the CRL-handling issue.
S2OPC cryptographic wrapper cryptographic_wrapper = MbedTLS

Event History

Jun 9, 2026

CVE Published

via MITRE·08:39 AM

Data Sourced

via MITRE·08:39 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-6899?

CVE-2026-6899 has a medium severity rating of 5.6.

How do I fix CVE-2026-6899?

To fix CVE-2026-6899, upgrade S2OPC to commit 3ff81301d95a77260e9deb791585a620c5623028 or to a release version greater than 1.7.2.

What is the risk associated with CVE-2026-6899?

CVE-2026-6899 carries a risk score of 42 due to its potential to allow connections using revoked certificates.

What software is affected by CVE-2026-6899?

CVE-2026-6899 affects the Systerel S2OPC software.

What is the main issue in CVE-2026-6899?

The main issue in CVE-2026-6899 is the improper check for certificate revocation that ignores valid CRLs from the same CA.