OpenSSL: Multiple vulnerabilities (CVE-2026-107496, CVE-2026-88822, CVE-2026-88823, CVE-2026-95691, CVE-2026-95692)
Multiple vulnerabilities discovered in OpenSSL across multiple release branches allow for remote denial-of-service, data confidentiality breaches, and security policy bypasses.
CVE search metadata
CVE search record: CVE-2026-107496. KEV: no. Product: OpenSSL (< 1.0.2zt), OpenSSL (< 1.1.1zk), OpenSSL (< 3.0.24), OpenSSL (< 3.5.10), OpenSSL (< 4.0.4), OpenSSL (< 4.1.1). Brief: OpenSSL: Multiple vulnerabilities (CVE-2026-107496, CVE-2026-88822, CVE-2026-88823, CVE-2026-95691, CVE-2026-95692). Brief link: https://feed.craftedsignal.io/briefs/2026-11-openssl-vulnerabilities/
CVE search record: CVE-2026-88822. KEV: no. Product: OpenSSL (< 1.0.2zt), OpenSSL (< 1.1.1zk), OpenSSL (< 3.0.24), OpenSSL (< 3.5.10), OpenSSL (< 4.0.4), OpenSSL (< 4.1.1). Brief: OpenSSL: Multiple vulnerabilities (CVE-2026-107496, CVE-2026-88822, CVE-2026-88823, CVE-2026-95691, CVE-2026-95692). Brief link: https://feed.craftedsignal.io/briefs/2026-11-openssl-vulnerabilities/
CVE search record: CVE-2026-88823. KEV: no. Product: OpenSSL (< 1.0.2zt), OpenSSL (< 1.1.1zk), OpenSSL (< 3.0.24), OpenSSL (< 3.5.10), OpenSSL (< 4.0.4), OpenSSL (< 4.1.1). Brief: OpenSSL: Multiple vulnerabilities (CVE-2026-107496, CVE-2026-88822, CVE-2026-88823, CVE-2026-95691, CVE-2026-95692). Brief link: https://feed.craftedsignal.io/briefs/2026-11-openssl-vulnerabilities/
CVE search record: CVE-2026-95691. KEV: no. Product: OpenSSL (< 1.0.2zt), OpenSSL (< 1.1.1zk), OpenSSL (< 3.0.24), OpenSSL (< 3.5.10), OpenSSL (< 4.0.4), OpenSSL (< 4.1.1). Brief: OpenSSL: Multiple vulnerabilities (CVE-2026-107496, CVE-2026-88822, CVE-2026-88823, CVE-2026-95691, CVE-2026-95692). Brief link: https://feed.craftedsignal.io/briefs/2026-11-openssl-vulnerabilities/
CVE search record: CVE-2026-95692. KEV: no. Product: OpenSSL (< 1.0.2zt), OpenSSL (< 1.1.1zk), OpenSSL (< 3.0.24), OpenSSL (< 3.5.10), OpenSSL (< 4.0.4), OpenSSL (< 4.1.1). Brief: OpenSSL: Multiple vulnerabilities (CVE-2026-107496, CVE-2026-88822, CVE-2026-88823, CVE-2026-95691, CVE-2026-95692). Brief link: https://feed.craftedsignal.io/briefs/2026-11-openssl-vulnerabilities/
Triage facts
Revision 1- Applicability
- OpenSSL (< 1.0.2zt), OpenSSL (< 1.1.1zk) +4
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 10, 16:33 UTC
- Vulnerabilities
- 5 CVEs
- Source quality
- A1Likely
The OpenSSL Project has released a security advisory addressing multiple vulnerabilities affecting the 1.0.2, 1.1.1, 3.0, 3.5, 4.0, and 4.1 release branches. These vulnerabilities may lead to remote denial-of-service, exposure of sensitive data, or bypass of security policies. Organizations should refer to the official OpenSSL security advisory for specific technical details and patch availability.
Impact
Successful exploitation may allow attackers to disrupt service availability (DoS), gain unauthorized access to sensitive information, or circumvent established security controls.
Recommendation
- Inventory all applications and services utilizing the OpenSSL library across the infrastructure.
- Patch all instances of OpenSSL to the identified secure versions or later: 1.0.2zt, 1.1.1zk, 3.0.24, 3.5.10, 4.0.4, or 4.1.1.
- Prioritize patching of internet-facing services or those handling sensitive user authentication and data.
Mitigations
Upgrade all OpenSSL library versions to 1.0.2zt, 1.1.1zk, 3.0.24, 3.5.10, 4.0.4, 4.1.1 or higher.
CVE-2026-107496, CVE-2026-88822, CVE-2026-88823, CVE-2026-95691, CVE-2026-95692