CVE-2026-82356: Imprivata EAM: Unrotatable X.509 RSA Key Pair in Production
Published Sep 23, 2026
·Updated
Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices.
Affected Software
1 affected component
Imprivata EAM<=26.2.6
Event History
Sep 23, 2026
CVE Published
via MITRE·06:25 PM
Data Sourced
via MITRE·06:25 PM
DescriptionWeakness
Data Sourced
via NVD·07:19 PM
Description
Frequently Asked Questions
1
Which deployments are affected?
Imprivata EAM versions 26.2.6 and earlier are affected when they generate an X.509 certificate using the RSA key pair described in the advisory.
2
What is the practical security concern?
The RSA key pair cannot be rotated after deployment, causing the same key pair to be used indefinitely for certificate generation. This conflicts with key-rotation best practices and can increase the impact of long-term key exposure.