Is CVE-2026-44900 actively exploited?

No active exploitation of CVE-2026-44900 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-44900 be exploited remotely?

Partially. CVE-2026-44900 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-44900?

CVE-2026-44900 has a CVSS score of 8.1 (HIGH).

HOME VULNERABILITIESCVE-2026-44900

HIGH

CVE-2026-44900

CWE-295Published: May 26, 2026· Updated: May 27, 2026

8.1

CVSS v3.1

Official Description

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.1, in SignedPublicKeysTrustValidatorImpl.isTrusted(), the ECDSA signature verification at line 45 discards the boolean return value of Signature.verify(). The method performs certificate chain validation, OCSP check, and signature algorithm setup, but never checks whether the signature actually matches. For any structurally valid signature, it returns true. This vulnerability is fixed in 1.2.1.

NVD Source

Technical Analysis

CVE-2026-44900 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 8.1.