Is CVE-2026-108265 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108265 being exploited in the wild.

How severe is CVE-2026-108265?

Informational severity, published 9 October 2026.

Which products and versions are affected?

Privasys Enclave OS Mini before wasm-v0.40.0.

Is there a fix for CVE-2026-108265?

Yes: fixed in wasm-v0.40.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108265 attacked?

It is attacked over the network.

Am I affected by CVE-2026-108265?

Check whether you run Privasys Enclave OS Mini at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108265: Enclave OS Mini RA-TLS quote relay in SGX enclaves

CVE-2026-108265 · Severity: info · Published 2026-10-09

Enclave OS Mini is a Rust-based runtime that allows applications to run securely inside Intel SGX enclaves, which are isolated processing environments used for sensitive computations. A flaw in its TLS certificate validation allowed an attacker who obtained a TLS private key to replay a legitimate security proof (quote) to fake a connection as the attested enclave, bypassing the intended security guarantees. This could allow an attacker to impersonate a secure enclave to systems relying on its attestation.

Vendors: Privasys.

Quick answers

Is CVE-2026-108265 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108265 being exploited in the wild.
How severe is CVE-2026-108265?: Informational severity, published 9 October 2026.
Which products and versions are affected?: Privasys Enclave OS Mini before wasm-v0.40.0.
Is there a fix for CVE-2026-108265?: Yes: fixed in wasm-v0.40.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108265 attacked?: It is attacked over the network.
Am I affected by CVE-2026-108265?: Check whether you run Privasys Enclave OS Mini at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: wasm-v0.40.0

Technical details

The RA-TLS challenge certificate path failed to include a session-binding value in the SGX quote's ReportData field, only including the certificate public-key hash and client nonce. An attacker who obtained the enclave's TLS private key could relay a genuine quote to a different connection, causing a relying party to accept an attacker-controlled TLS termination as coming from the attested enclave. The fix adds channel binding by committing a 32-byte binder derived from the TLS handshake key schedule to the quote's ReportData, verified post-handshake by the verifier.

Affected products

Privasys Enclave OS Mini before wasm-v0.40.0

Timeline

2026-07-10: patched: Fix commit implementing channel binding
2026-10-09: advisory
2026-10-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.