Is CVE-2026-28389 actively exploited?

No active exploitation of CVE-2026-28389 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-28389 be exploited remotely?

Yes. CVE-2026-28389 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-28389?

CVE-2026-28389 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-28389

HIGH

CVE-2026-28389

CWE-476Published: April 7, 2026· Updated: Apr 10, 2026

7.5

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:8.4th

Official Description

Issue summary: During processing of a crafted CMS EnvelopedData message

with KeyAgreeRecipientInfo a NULL pointer dereference can happen.

Impact summary: Applications that process attacker-controlled CMS data may

crash before authentication or cryptographic operations occur resulting in

Denial of Service.

When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is

processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier

is examined without checking for its presence. This results in a NULL

pointer dereference if the field is missing.

Applications and services that call CMS_decrypt() on untrusted input

(e.g., S/MIME processing or CMS-based protocols) are vulnerable.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this

issue, as the affected code is outside the OpenSSL FIPS module boundary.

NVD Source

Technical Analysis

CVE-2026-28389 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 7.5.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityNone

IntegrityNone

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Vendors & Products

Mentioned vendors (from description):

OpenSSL

CPE data not yet available in NVD for this CVE.

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

News & Research Mentioning CVE-2026-28389

Siemens SIMATIC

CISA Alerts· May 14, 2026

View CSAF Summary SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version. The following versions of Siemens SIMATIC are affected: SIMATIC CN 4100 vers:intdot/ hpo_dp_link_enc before using it [WHAT & HOW] Functions dp_enable_link_phy and dp_disable_link_phy can pass link_res without initializing hpo_dp_link_enc and it is necessary to check for null before dereferencing. This fixes 2 FORWARD_NULL issues reported by Coverity. View CVE Details Affected Products Siemens SIMATIC Vendor: Siemens Product Version: SIMATIC CN 4100 Product Status: known_affected Remediations [xlite_meta score:79 src:CISA Alerts xlite_fp:24398be83460e8bd8b0800e5360a3f73a2eb239b4cfc4a9afb9694e799548978]