SEPTEMBER 20, 2026
Live Feed
Back to database
Case File

CVE-2026-12816

HIGH · CVSS 8.7 EPSS 0.17% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-03 · Last synced 2026-09-02

CyberRota Analysis

AI-Generated

Bouncy Castle for Java versions prior to 1.85 and LTS versions before 2.73.12 are vulnerable to a stream-mode MAC forgery due to a flaw in the length-dependent key derivation function (KDF) split in the IESEngine. This vulnerability could allow an attacker to forge message authentication codes, potentially compromising the integrity of cryptographic operations. Organizations using affected versions of Bouncy Castle should prioritize patching to mitigate risks associated with this vulnerability.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-12816
Severity
HIGH
CVSS
8.7
EPSS
0.17%
Java

Original NVD Description

In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12.