CVE-2026-86231
mwiede jsch KnownHosts.java getRevokedKeys improper check for certificate revocation
A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate revocation. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.28.6 is able to address this issue. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. You should upgrade the affected component.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
mwiede jsch KnownHosts.java getRevokedKeys improper check for certificate revocation
A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate revocation. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.28.6 is able to address this issue. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. You should upgrade the affected component.
- Record
CVE-2026-86231- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C - CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C - CVSS 2.0
- 2.6
AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C - Weakness
- CWE-299, CWE-298
- Updated
- 2026-11-02
EUVDEUVD-2026-72179
A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate revocation. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.28.6 is able to address this issue. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. You should upgrade the affected component.
- Record
EUVD-2026-72179- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x2rp-h5qg-fmqg
A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function...
A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate revocation. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.28.6 is able to address this issue. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. You should upgrade the affected component.
- Record
GHSA-x2rp-h5qg-fmqg- CVSS 4.0
- 2.9 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-298
- Updated
- 2026-11-02
NVD
A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate revocation. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.28.6 is able to address this issue. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. You should upgrade the affected component.
- Record
CVE-2026-86231- CVSS 4.0
- 2.9 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:N/I:P/A:N - Weakness
- CWE-298, CWE-299
- Updated
- 2026-11-02
OSV
mwiede jsch KnownHosts.java getRevokedKeys improper check for certificate revocation
A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate revocation. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.28.6 is able to address this issue. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. You should upgrade the affected component.
- Record
CVE-2026-86231- CVSS 4.0
- 2.9 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-298, CWE-299
- Updated
- 2026-11-03
OSVDEBIAN-CVE-2026-86231
A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate revocation. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.28.6 is able to address this issue. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. You should upgrade the affected component.
- Record
DEBIAN-CVE-2026-86231- CVSS 4.0
- 2.9 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-86231
A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate revocation. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.28.6 is able to address this issue. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. You should upgrade the affected component.
- Record
UBUNTU-CVE-2026-86231- CVSS 4.0
- 2.9 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11814-1 No score
jsch-2.28.7-1.1 on GA media
These are all security issues fixed in the jsch-2.28.7-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11814-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:5017-1 No score
Security update for apache-commons-codec, apache-commons-io, apache-commons-logging, avalon-framework, avalon-logkit, glassfish-jsp, jsch, maven-file-management, opentest4j
This update for apache-commons-codec, apache-commons-io, apache-commons-logging, avalon-framework, avalon-logkit, glassfish-jsp, jsch, maven-file-management, opentest4j fixes the following issue:
- CVE-2026-86231: improper check for certificate revocation when processing
known_hostsentries (bsc#1279889).
Changes for apache-commons-codec:
- Updated to version 1.22.0.
Changes for apache-commons-io:
- Updated to version 2.22.0.
Changes for apache-commons-logging:
- Updated to version 1.4.0.
Changes for jsch:
- Updated to version 2.28.7.
Changes for maven-file-management:
- Updated to version 3.2.0.
Changes for opentest4j:
- Updated to version 1.3.0.
- Record
SUSE-SU-2026:5017-1- Updated
- 2026-11-03
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jschDebian:12 |
All versions, plus listed versions 0.1.55-10.1.55-20.2.19-10.2.19-1~exp0 |
None known |
jschDebian:13 |
All versions, plus listed versions 0.2.19-1 |
None known |
jschDebian:14 |
All versions, plus listed versions 0.2.19-1 |
None known |
apache-commons-codecSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 1.22.0-150200.3.12.1 | 1.22.0-150200.3.12.1 |
apache-commons-ioSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 2.22.0-150200.3.18.1 | 2.22.0-150200.3.18.1 |
apache-commons-loggingSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 1.4.0-150200.11.12.1 | 1.4.0-150200.11.12.1 |
jschSUSE:Linux Enterprise Module for Development Tools 15 SP7 |
before 2.28.7-150200.11.19.1 | 2.28.7-150200.11.19.1 |
maven-file-managementSUSE:Linux Enterprise Module for Development Tools 15 SP7 |
before 3.2.0-150200.3.10.1 | 3.2.0-150200.3.10.1 |
opentest4jSUSE:Linux Enterprise Module for Development Tools 15 SP7 |
before 1.3.0-150200.3.9.1 | 1.3.0-150200.3.9.1 |
glassfish-jspSUSE:Linux Enterprise Module for Package Hub 15 SP7 |
before 2.3.4-150200.3.7.1 | 2.3.4-150200.3.7.1 |
Show 86 moreShow less
| Package | Affected | Fixed |
|---|---|---|
opentest4jSUSE:Linux Enterprise Module for Package Hub 15 SP7 |
before 1.3.0-150200.3.9.1 | 1.3.0-150200.3.9.1 |
apache-commons-codecSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 1.22.0-150200.3.12.1 | 1.22.0-150200.3.12.1 |
apache-commons-ioSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 2.22.0-150200.3.18.1 | 2.22.0-150200.3.18.1 |
apache-commons-loggingSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 1.4.0-150200.11.12.1 | 1.4.0-150200.11.12.1 |
avalon-frameworkSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 4.3-150200.3.9.1 | 4.3-150200.3.9.1 |
avalon-framework-apiSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 4.3-150200.3.9.1 | 4.3-150200.3.9.1 |
avalon-logkitSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 2.1-150200.11.9.1 | 2.1-150200.11.9.1 |
jschSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 2.28.7-150200.11.19.1 | 2.28.7-150200.11.19.1 |
maven-file-managementSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 3.2.0-150200.3.10.1 | 3.2.0-150200.3.10.1 |
opentest4jSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 1.3.0-150200.3.9.1 | 1.3.0-150200.3.9.1 |
apache-commons-codecSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 1.22.0-150200.3.12.1 | 1.22.0-150200.3.12.1 |
apache-commons-ioSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 2.22.0-150200.3.18.1 | 2.22.0-150200.3.18.1 |
apache-commons-loggingSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 1.4.0-150200.11.12.1 | 1.4.0-150200.11.12.1 |
avalon-frameworkSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 4.3-150200.3.9.1 | 4.3-150200.3.9.1 |
avalon-framework-apiSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 4.3-150200.3.9.1 | 4.3-150200.3.9.1 |
avalon-logkitSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 2.1-150200.11.9.1 | 2.1-150200.11.9.1 |
jschSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 2.28.7-150200.11.19.1 | 2.28.7-150200.11.19.1 |
maven-file-managementSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 3.2.0-150200.3.10.1 | 3.2.0-150200.3.10.1 |
opentest4jSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 1.3.0-150200.3.9.1 | 1.3.0-150200.3.9.1 |
apache-commons-codecSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 1.22.0-150200.3.12.1 | 1.22.0-150200.3.12.1 |
apache-commons-ioSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 2.22.0-150200.3.18.1 | 2.22.0-150200.3.18.1 |
apache-commons-loggingSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 1.4.0-150200.11.12.1 | 1.4.0-150200.11.12.1 |
avalon-logkitSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 2.1-150200.11.9.1 | 2.1-150200.11.9.1 |
jschSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 2.28.7-150200.11.19.1 | 2.28.7-150200.11.19.1 |
maven-file-managementSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 3.2.0-150200.3.10.1 | 3.2.0-150200.3.10.1 |
opentest4jSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 1.3.0-150200.3.9.1 | 1.3.0-150200.3.9.1 |
apache-commons-codecSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 1.22.0-150200.3.12.1 | 1.22.0-150200.3.12.1 |
apache-commons-ioSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 2.22.0-150200.3.18.1 | 2.22.0-150200.3.18.1 |
apache-commons-loggingSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 1.4.0-150200.11.12.1 | 1.4.0-150200.11.12.1 |
avalon-logkitSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 2.1-150200.11.9.1 | 2.1-150200.11.9.1 |
jschSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 2.28.7-150200.11.19.1 | 2.28.7-150200.11.19.1 |
maven-file-managementSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 3.2.0-150200.3.10.1 | 3.2.0-150200.3.10.1 |
opentest4jSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 1.3.0-150200.3.9.1 | 1.3.0-150200.3.9.1 |
apache-commons-codecSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 1.22.0-150200.3.12.1 | 1.22.0-150200.3.12.1 |
apache-commons-ioSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 2.22.0-150200.3.18.1 | 2.22.0-150200.3.18.1 |
apache-commons-loggingSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 1.4.0-150200.11.12.1 | 1.4.0-150200.11.12.1 |
avalon-frameworkSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 4.3-150200.3.9.1 | 4.3-150200.3.9.1 |
avalon-framework-apiSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 4.3-150200.3.9.1 | 4.3-150200.3.9.1 |
avalon-logkitSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 2.1-150200.11.9.1 | 2.1-150200.11.9.1 |
jschSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 2.28.7-150200.11.19.1 | 2.28.7-150200.11.19.1 |
maven-file-managementSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 3.2.0-150200.3.10.1 | 3.2.0-150200.3.10.1 |
opentest4jSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 1.3.0-150200.3.9.1 | 1.3.0-150200.3.9.1 |
apache-commons-codecSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 1.22.0-150200.3.12.1 | 1.22.0-150200.3.12.1 |
apache-commons-ioSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 2.22.0-150200.3.18.1 | 2.22.0-150200.3.18.1 |
apache-commons-loggingSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 1.4.0-150200.11.12.1 | 1.4.0-150200.11.12.1 |
avalon-logkitSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 2.1-150200.11.9.1 | 2.1-150200.11.9.1 |
jschSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 2.28.7-150200.11.19.1 | 2.28.7-150200.11.19.1 |
maven-file-managementSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 3.2.0-150200.3.10.1 | 3.2.0-150200.3.10.1 |
opentest4jSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 1.3.0-150200.3.9.1 | 1.3.0-150200.3.9.1 |
apache-commons-codecSUSE:Linux Enterprise Server 15 SP6-LTSS |
before 1.22.0-150200.3.12.1 | 1.22.0-150200.3.12.1 |
apache-commons-ioSUSE:Linux Enterprise Server 15 SP6-LTSS |
before 2.22.0-150200.3.18.1 | 2.22.0-150200.3.18.1 |
apache-commons-loggingSUSE:Linux Enterprise Server 15 SP6-LTSS |
before 1.4.0-150200.11.12.1 | 1.4.0-150200.11.12.1 |
jschSUSE:Linux Enterprise Server 15 SP6-LTSS |
before 2.28.7-150200.11.19.1 | 2.28.7-150200.11.19.1 |
maven-file-managementSUSE:Linux Enterprise Server 15 SP6-LTSS |
before 3.2.0-150200.3.10.1 | 3.2.0-150200.3.10.1 |
opentest4jSUSE:Linux Enterprise Server 15 SP6-LTSS |
before 1.3.0-150200.3.9.1 | 1.3.0-150200.3.9.1 |
apache-commons-codecSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 1.22.0-150200.3.12.1 | 1.22.0-150200.3.12.1 |
apache-commons-ioSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 2.22.0-150200.3.18.1 | 2.22.0-150200.3.18.1 |
apache-commons-loggingSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 1.4.0-150200.11.12.1 | 1.4.0-150200.11.12.1 |
avalon-frameworkSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 4.3-150200.3.9.1 | 4.3-150200.3.9.1 |
avalon-framework-apiSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 4.3-150200.3.9.1 | 4.3-150200.3.9.1 |
avalon-logkitSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 2.1-150200.11.9.1 | 2.1-150200.11.9.1 |
jschSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 2.28.7-150200.11.19.1 | 2.28.7-150200.11.19.1 |
maven-file-managementSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 3.2.0-150200.3.10.1 | 3.2.0-150200.3.10.1 |
opentest4jSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 1.3.0-150200.3.9.1 | 1.3.0-150200.3.9.1 |
apache-commons-codecSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 1.22.0-150200.3.12.1 | 1.22.0-150200.3.12.1 |
apache-commons-ioSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 2.22.0-150200.3.18.1 | 2.22.0-150200.3.18.1 |
apache-commons-loggingSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 1.4.0-150200.11.12.1 | 1.4.0-150200.11.12.1 |
avalon-logkitSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 2.1-150200.11.9.1 | 2.1-150200.11.9.1 |
jschSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 2.28.7-150200.11.19.1 | 2.28.7-150200.11.19.1 |
maven-file-managementSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 3.2.0-150200.3.10.1 | 3.2.0-150200.3.10.1 |
opentest4jSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 1.3.0-150200.3.9.1 | 1.3.0-150200.3.9.1 |
apache-commons-codecSUSE:Linux Enterprise Server for SAP Applications 15 SP6 |
before 1.22.0-150200.3.12.1 | 1.22.0-150200.3.12.1 |
apache-commons-ioSUSE:Linux Enterprise Server for SAP Applications 15 SP6 |
before 2.22.0-150200.3.18.1 | 2.22.0-150200.3.18.1 |
apache-commons-loggingSUSE:Linux Enterprise Server for SAP Applications 15 SP6 |
before 1.4.0-150200.11.12.1 | 1.4.0-150200.11.12.1 |
jschSUSE:Linux Enterprise Server for SAP Applications 15 SP6 |
before 2.28.7-150200.11.19.1 | 2.28.7-150200.11.19.1 |
maven-file-managementSUSE:Linux Enterprise Server for SAP Applications 15 SP6 |
before 3.2.0-150200.3.10.1 | 3.2.0-150200.3.10.1 |
opentest4jSUSE:Linux Enterprise Server for SAP Applications 15 SP6 |
before 1.3.0-150200.3.9.1 | 1.3.0-150200.3.9.1 |
jschUbuntu:14.04:LTS |
All versions, plus listed versions 0.1.48-0ubuntu10.1.50-1ubuntu1 |
None known |
jschUbuntu:16.04:LTS |
All versions, plus listed versions 0.1.53-1ubuntu1 |
None known |
jschUbuntu:18.04:LTS |
All versions, plus listed versions 0.1.54-1 |
None known |
jschUbuntu:20.04:LTS |
All versions, plus listed versions 0.1.55-1 |
None known |
jschUbuntu:22.04:LTS |
All versions, plus listed versions 0.1.55-1 |
None known |
jschUbuntu:24.04:LTS |
All versions, plus listed versions 0.1.55-1 |
None known |
jschUbuntu:26.10 |
All versions, plus listed versions 0.2.19-1build1 |
None known |
jschUbuntu:26.04:LTS |
All versions, plus listed versions 0.2.19-10.2.19-1build1 |
None known |
jschopenSUSE:Tumbleweed |
before 2.28.7-1.1 | 2.28.7-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-86231 is a medium vulnerability (CVSS 6.3) in Microsoft Jsch, published September 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in apache-commons-codec 1.22.0-150200.3.12.1.
References
vuldb.com/vuln/399388
github.com/mwiede/jsch/issues/1091
Show 12 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-86231
security-tracker.debian.org/tracker/CVE-2026-86231
suse.com/support/update/announcement/2026/suse-su-20265017-1
bugzilla.suse.com/1279889
ubuntu.com/security/CVE-2026-86231
cve.org/CVERecord?id=CVE-2026-86231