CVE-2025-26787
Keyfactor Signserver ≤ 7.2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:LSummary
CVE-2025-26787 is a medium-severity External Control of Critical State Data (CWE-642) vulnerability in Keyfactor Signserver. Its CVSS base score is 4.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Access Token Manipulation (T1134); ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-204738
Vulnerability Data
An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2. The Admin CLI command used to configure Certificate access to the initial startup of the container sets a property of "allowany" to allow…
more
any user with a valid and trusted client auth certificate to connect. Admins can then set more restricted access to specific certificates. A logic error caused this admin CLI command to be run on each restart of the container instead of only the first startup as intended resetting the configuration to "allowany".
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 4 hardening rules · 3 OS baselines
V8.4.2
Mitigating Controls (NIST 800-53 r5) AI
Enforces access authorizations on the stored critical state data so unauthorized actors cannot read or modify it.
Limits which subjects may access the location holding security-critical state, reducing the set of actors that can tamper with it.
Requires cryptographic or other protection of information at rest, directly blocking unauthorized external access to critical state.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Protecting integrity of data-at-rest stops external tampering with stored security-critical state.
Enforcing least-privilege access permissions directly prevents unauthorized actors from reaching critical state data.
Network-level controls reduce the attack surface that would otherwise allow external modification of state.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure architecture principles discourage external control of security-critical state.
Information access restriction mechanisms enforce least-privilege access to critical state.
Access control policies directly limit who can read or modify security-critical state data.
Managing access rights prevents unauthorized actors from altering critical state stored externally.
Restricting privileged access rights reduces the chance that state data can be tampered with by unauthorized users.
Secure development practices can avoid placing critical state in externally writable locations.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248525 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. prevents CWE-642
Oracle Linux 9 (2 rules)
- V-271811 OL 9 /etc/passwd- file must have mode 0644 or less permissive to prevent unauthorized access. prevents CWE-642
- V-271756 OL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-642
RHEL 7 (1 rule)
- V-204627 SNMP community strings on the Red Hat Enterprise Linux operating system must be changed from the default. prevents CWE-642