Root CA Sibling Keys Compromise SWUpdate Firmware Validation in CVE-2026-109399

A critical vulnerability in SWUpdate allows malicious firmware installation through improper certificate validation. The flaw affects versions up to 2026.05.1 and enables attackers to bypass security checks using sibling intermediate certificates.

What happened

The National Vulnerability Database lists CVE-2026-109399 as a critical issue with a CVSS score of 9.2. The flaw is located in the crypto/swupdate_cms_verify_openssl.c component of SWUpdate. According to the NVD record, the software incorrectly validates X.509 certificates embedded in CMS SignedData objects. This improper validation allows the system to trust untrusted certificates during the chain-building process.

The vulnerability affects all SWUpdate versions through 2026.05.1. The NVD classifies the weakness under CWE-295, which covers improper certificate validation. The issue was identified in the codebase maintained by sbabic. No patch or fix has been confirmed yet for this specific vulnerability. The record does not mention any active exploitation or widespread attacks.

Why it matters

Attackers who possess a signing key from a sibling intermediate certificate can exploit this flaw. These sibling intermediates share the same root certificate as the legitimate signing authority. By embedding the sibling intermediate in the signature, attackers can trick SWUpdate into accepting malicious updates. This bypasses the intended security controls designed to verify firmware integrity.

Organizations using SWUpdate for device management face significant risk. The ability to install unauthorized firmware can lead to full device compromise. Since the flaw relies on certificate chain building, standard signature checks may not detect the intrusion. This undermines the trust model that depends on strict root and intermediate validation. The critical severity rating reflects the high potential for impact on affected systems.

What to watch

• Monitor vendor announcements for patches addressing CVE-2026-109399.
• Review current SWUpdate versions in your deployment environment.
• Check if any devices are running versions prior to 2026.05.1.
• Look for unusual firmware update activities or certificate errors.

What to do and how to stay safe: SWUpdate

• Audit your inventory to identify all devices running SWUpdate versions up to 2026.05.1.
• Restrict network access for devices that cannot be immediately updated to reduce exposure.
• Monitor logs for unexpected firmware installation attempts or certificate validation failures.
• Prepare a contingency plan to manually verify firmware signatures once a vendor update is available.

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-109399?

The National Vulnerability Database rates CVE-2026-109399 as CVSS 9.2 Critical.

Which versions of SWUpdate are affected?

All SWUpdate versions through 2026.05.1 contain this improper certificate validation vulnerability.

How do attackers exploit this flaw?

Attackers use signing keys from sibling intermediate certificates under the same root to embed malicious updates.