CVE-2026-114406
Allows man-in-the-middle attack on TLS via weak intermediate CA certificates
Weak private keys in eMudhra intermediate certificates let attackers issue fraudulent TLS certificates trusted by affected systems. This vulnerability impacts Red Hat Enterprise Linux 10 and other products using ca-certificates RPM packages. The fix involves removing the root CAs that signed these intermediates; no specific version fix is yet available.
Red Hat Red Hat Enterprise Linux 10 · Updated 9 Nov · From 1 of our story and the public records
Being exploitedNot reportedNo attacks reported in the records
CISA known exploitedNot listedThe US list of flaws under attack
SeveritymediumCVSS 6.8 of 10
FixAvailableFixed versions below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- No workaround is available; apply updates to the ca-certificates package when released by Red Hat.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-114406 | Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns | medium 6.8 | No | 0.3% |
Our reporting
9 NovMicrosoft rolls out Azure Linux update with more than 470 CVE referencesReported elsewhere
www.theregister.com - Articles · 9 NovMicrosoft's Azure Linux gets 470-plus security fixes in one almighty patching session ↗The records
access.redhat.com: advisory ↗access.redhat.com: advisory ↗access.redhat.com: advisory ↗access.redhat.com: advisory ↗CVE-2026-114406 on NVD ↗Is anything you run affected?Connect Zotpaper to Claude, ChatGPT or Cursor and ask. It checks your project's packages against this vulnerability and every other one in the advisory databases, and says what to update. Your first 20 lookups are free.
Try it free