Cyber Resilience

CVE-2026-8149

Published
08 May 2026
Modified
21 July 2026
CVSS Score v4 5.1
Click a component to see what it means
Raw vectorCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:X/V:X/RE:M/U:Amber
EPSS Score 0.0016 5th percentile
Risk Priority 28 floored blend · peak EPSS

Summary

CVE-2026-8149 is a medium-severity Inconsistency Between Implementation and Documented Design (CWE-1068) vulnerability. Its CVSS base score is 5.1 (Medium).

Operationally, ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-10 (Developer Configuration Management) and SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on X86_64, AVX, AVX-512f, Linux, Legion of the Bouncy Castle Inc. BC-FJA bc-fips on Linux, X86_64, AVX, AVX-512f. This vulnerability is associated with program files gcm128w, gcm512w, gcm128w.C, gcm512w.C.…

more

This issue affects BC-LTS: from 2.73.0 before 2.73.11; BC-FJA: from 2.1.0 before 2.1.3.

CWE(s)
CWE-1068

Related Threats

CVEs Like This One

CVE-2025-48905Shared CWE-1068
CVE-2024-43798Shared CWE-1068
CVE-2024-3845Shared CWE-1068

Affected Assets

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 3 hardening rules · 2 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V7.1.1

Mitigating Controls (NIST 800-53 r5) AI

SA-10 Developer Configuration Management partial match

Requires developer configuration management that tracks and controls changes to both design and code, reducing divergence between them.

SA-11 Developer Testing and Evaluation partial match

Developer testing and evaluation activities directly examine whether the delivered implementation satisfies documented design and requirements.

SA-15 Development Process, Standards, and Tools partial match

Requires the developer to follow a documented development process that explicitly includes maintaining consistency between design artifacts and implementation.

SA-3 System Development Life Cycle partial match

Mandates use of an SDLC that incorporates security and privacy activities, thereby structuring development to keep implementation aligned with documented design.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices include design-to-code verification activities that directly address implementation versus documented design mismatches.

ID.RA-07 partial match
prevents

Formal change and exception tracking reduces uncontrolled drift from documented designs but does not verify consistency.

PR.PS-01 partial match
prevents

Configuration management verifies deployed state against documented baselines, catching some but not all design-implementation drift.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect deviations, yet does not prevent the inconsistency from occurring.

A.8.32 Change management mostly match
prevents

Change management can catch drift after the fact, but does not guarantee initial implementation matches design.

A.5.37 Documented operating procedures partial match
degrades

Documented operating procedures help keep implementation aligned with stated design, but do not enforce design-level consistency.

A.5.8 Information security in project management partial match
prevents

Project-level design-to-implementation traceability directly reduces divergence between documented design and delivered code.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC mandates that implementation matches documented design artifacts, catching the inconsistency early.

A.8.26 Application security requirements partial match
prevents

Application security requirements can reference design, but do not themselves ensure implementation matches that design.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

Oracle Linux 8 (1 rule)
  • V-248873 The Trivial File Transfer Protocol (TFTP) server package must not be installed if not required for OL 8 operational support. prevents CWE-1068
RHEL 7 (2 rules)
  • V-204392 The Red Hat Enterprise Linux operating system must be configured so that the file permissions, ownership, and group membership of system files and commands match the vendor values. prevents CWE-1068
  • V-204621 The Red Hat Enterprise Linux operating system must not have the Trivial File Transfer Protocol (TFTP) server package installed if not required for operational support. prevents CWE-1068

References