CRITICALCVSS 9.1Vulnerability

CVE-2026-8763

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Properties

severity
CRITICAL
cvss_severity
CRITICAL
cvss_score
9.1
epss_score
0.00451
retrieved_at
2026-09-25T15:12:24+00:00
last_source
FIRST EPSS
score
9.1
cve_id
CVE-2026-8763
cvss_vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
signal_observed_at
2026-09-11T17:55:57+00:00
vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
published_at
2026-08-03T01:16:45.807
last_modified
2026-09-02T14:28:48.940
epss_percentile
0.36573

Related Entities (6)

AFFECTS_PRODUCT (3)

→[Product]
→[Product]
→[Product]

ENRICHED_BY (1)

→[Source]FIRST EPSS

DESCRIBED_BY (1)

→[Source]NVD

HAS_WEAKNESS (1)

→[Weakness]Improper Certificate Validation

Explore deeper with Ninja Signal's threat intelligence graph

CVE-2026-8763 (CVSS 9.1) — Ninja Signal Threat Intelligence | Ninja Signal