Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Critical severity, with a CVSS score of 4, published 20 October 2026.

Which products and versions are affected?

Certifi >=2019.03.09, = 2019.03.09, =2019.03.09.

Is there a fix for This vulnerability?

Yes. certifi (PyPI): upgrade to 2026.10.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Certifi, certifi (PyPI) or Python Software Foundation Certifi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

certifi emSign root CAs with compromised intermediate keys

Severity: critical · CVSS 4 · Published 2026-10-20

Certifi, a library that provides trusted SSL/TLS certificate authorities for Python applications, bundled root certificates from emSign whose intermediate certificate keys were compromised. An attacker with access to these compromised keys could forge SSL/TLS certificates to impersonate legitimate websites and intercept encrypted connections, enabling data theft or account takeover.

Technologies: certifi (PyPI). Vendors: PyPI, Python Software Foundation.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Critical severity, with a CVSS score of 4, published 20 October 2026.
Which products and versions are affected?: Certifi >=2019.03.09, <2026.10.19; certifi (PyPI) >= 2019.03.09, < 2026.10.19, ECOSYSTEM:introduced=2019.03.09,fixed=2026.10.19; Python Software Foundation Certifi >=2019.03.09.
Is there a fix for This vulnerability?: Yes. certifi (PyPI): upgrade to 2026.10.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Certifi, certifi (PyPI) or Python Software Foundation Certifi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

certifi (PyPI): upgrade to 2026.10.19 or later
```
pip install "certifi>=2026.10.19"
```

Technical details

Certifi bundled emSign root CA certificates whose intermediate CAs had revoked keys due to compromise. An attacker possessing the compromised intermediate key can issue fraudulent certificates that will be trusted by any application using certifi for certificate validation, enabling man-in-the-middle attacks on HTTPS connections. The vulnerability affects all versions from 2019.03.09 onwards; a fix is available in certifi 2026.10.18.

Affected products

Python Software Foundation certifi >=2019.03.09

Identifiers

GHSA-6q48-6c7w-9gw2
PYSEC-2026-4320

Timeline

2026-10-20: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.