CRITICAL 9.3 NVD
CVE-2026-81701
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unkno
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths to achieve arbitrary code execution in the CLI process with access to passwords and cryptographic keys.
References
- https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-wxx9-p55f-wm34
- https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-arbitrary-code-execution
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-08-27 via NVD.
Risk Timeline
CVE Disclosed2026-08-27 · -1 days ago
Remediation Resources
vulnfeed aggregates 11337 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.