CVE-2026-6899: medium-severity vulnerability in Systerel S2OPC
Improper Check for Certificate Revocation in S2OPC
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.6epss 0.1%
Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in the CycloneCrypto cryptographic wrapper of S2OPC library. It might allow connection between an OPC UA client and server using a revoked certificate.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
Systerel · S2OPCRelated CVEs — Systerel S2OPC
In the same product, most dangerous first.
CVE-2026-78049MEDIUMSysterel S2OPC AddNodes Service sopc_node_mgt_helper_internal.c out-of-boundsEPSS 0.6%CVE-2026-90782MEDIUMS2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_items()EPSS 0.6%CVE-2026-82619MEDIUMSysterel S2OPC subscription_mgr.c use after freeEPSS 0.5%CVE-2026-82618MEDIUMSysterel S2OPC String Array Range Writing sopc_builtintypes.c set_range_matrix_on_string_array out-of-boundsEPSS 0.5%CVE-2026-18790MEDIUMSysterel S2OPC DeleteMonitoredItemsRequest state_machine.c out-of-boundsEPSS 0.2%CVE-2026-18257MEDIUMImproper Certificate Validation in S2OPCEPSS 0.2%