CVE-2026-86231 (CVSS 3.7)

Description

A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate revocation. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.28.6 is able to address this issue. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. You should upgrade the affected component.

Is your site exposed to CVE-2026-86231?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

3.7

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS — Exploit Prediction

0.0027

Probability of exploitation

0.20%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-298 CWE-298

CWE-299 CWE-299

References

Other References

https://github.com/mwiede/jsch/ https://github.com/mwiede/jsch/commit/194a2f76a5c0f1c3f778565be3fd66bcafc42d23 https://github.com/mwiede/jsch/issues/1091 https://github.com/mwiede/jsch/pull/1098 https://github.com/mwiede/jsch/releases/tag/jsch-2.28.6 https://vuldb.com/cve/CVE-2026-86231 https://vuldb.com/submit/898485 https://vuldb.com/vuln/399388 https://vuldb.com/vuln/399388/cti

Frequently Asked Questions

What is CVE-2026-86231? +

A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate revocation. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.28.6 is able to address this issue. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. You should upgrade the affected component. It has a CVSS v3.1 base score of 3.7 (LOW).

How severe is CVE-2026-86231? +

CVE-2026-86231 has a CVSS v3.1 score of 3.7 out of 10, rated LOW. This is a low-severity vulnerability with limited impact. The EPSS score is 0.0027, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-86231? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-4384

The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not …

CVE-2025-61736

Successful exploitation of this vulnerability could result in the product failing to re-establish communication once the certificate expires.

CVE-2025-67108 10.0

eProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket revocation, resulting in insecure communications and connections.

CVE-2025-67109 10.0

Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execute …

CVE-2025-59036 5.5

Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in …

CVE-2024-1248 4.8

The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when …

CVE-2026-86231