CVE-2026-23966

Critical

Published: 22 January 2026

Published

22 January 2026

Modified

25 February 2026

KEV Added

—

Patch

—

CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Score 0.0001 0.9th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-23966 is a critical-severity Insufficient Verification of Data Authenticity (CWE-345) vulnerability in Juneandgreen Sm-Crypto. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 0.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly requires timely remediation of identified software flaws, such as upgrading the vulnerable sm-crypto library to version 0.3.14 to eliminate the SM2 private key recovery vulnerability.

RA-5 Vulnerability Monitoring and Scanning partial match

detect

Mandates vulnerability scanning of systems and dependencies to identify known issues like CVE-2026-23966 in the sm-crypto JavaScript library.

SI-4 System Monitoring partial match

detect

Enables monitoring of system activity to detect anomalous patterns, such as the repeated SM2 decryption interactions required to exploit the private key recovery vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1552.004 Private Keys Credential Access

Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials.

attack.mitre.org →

Why these techniques?

Remote exploitation of exposed SM2 decryption (T1190) directly enables private key recovery (T1552.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto prior to version 0.3.14. By interacting with the SM2 decryption interface multiple times, an…

attacker can fully recover the private key within approximately several hundred interactions. Version 0.3.14 patches the issue.

Deeper analysisAI

CVE-2026-23966 is a private key recovery vulnerability in the SM2 decryption logic of the sm-crypto JavaScript library, which implements Chinese cryptographic algorithms SM2, SM3, and SM4. Versions of sm-crypto prior to 0.3.14 are affected, enabling an attacker to fully recover the private key through repeated interactions with the decryption interface, typically requiring only several hundred calls.

The vulnerability has a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating it is exploitable remotely over a network with low complexity, no privileges or user interaction required. An unauthenticated attacker can target any application or service exposing the sm-crypto SM2 decryption functionality, such as web applications or Node.js services using the library for SM2 operations, to extract the underlying private key and potentially decrypt sensitive data or forge signatures.

The sm-crypto security advisory (GHSA-pgx9-497m-6c4v) and the patching commit (b1c824e58fdf1eaa73692c124a095819a8c45707) confirm that upgrading to version 0.3.14 resolves the issue by addressing the flawed decryption logic. Security practitioners should audit dependencies for vulnerable sm-crypto versions and apply the patch immediately, especially in environments handling Chinese national cryptographic standards.