Is CVE-2026-117611 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-117611 being exploited in the wild.

How severe is CVE-2026-117611?

Informational severity, published 29 October 2026.

Which products and versions are affected?

Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52, 2.2.0 (EOL).

How is CVE-2026-117611 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-117611?

Check whether you run Checkmk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-117611: Checkmk improper certificate validation in CA store

Q: Which products and versions are affected?

Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52, 2.2.0 (EOL).

Q: Is there a fix for CVE-2026-117611?

Yes: fixed in Checkmk 2.5.0p18, 2.4.0p39, 2.3.0p52. Until then: Keep the operating system CA certificate store up to date. If using custom trusted certificate authorities, ensure they are properly configured in the site's SSL settings to override the bundled CA store. [ { "kind": "disclosed", "at": "2026-10-17", "note": "Mozilla received report of compromised eMudhra private keys" }, { "kind": "advisory", "at": "2026-10-29", "note": "CVE-2026-117611 published" }, { "kind": "patched", "at": "2026-10-23", "note": "Checkmk patches released removing untrusted eMudhra root CAs" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-117611 · Severity: info · Published 2026-10-29

Checkmk, a monitoring and alerting platform, bundles root certificate authorities (CAs) that were used to validate HTTPS connections. The eMudhra (emSign) root CA certificates included in this bundle had their private keys publicly compromised, allowing attackers to forge valid certificates for any domain. This could enable attackers to intercept and manipulate HTTPS traffic that Checkmk uses to monitor systems.

Technologies: Checkmk. Vendors: Checkmk.

Quick answers

Is CVE-2026-117611 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-117611 being exploited in the wild.
How severe is CVE-2026-117611?: Informational severity, published 29 October 2026.
Which products and versions are affected?: Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52, 2.2.0 (EOL).
Is there a fix for CVE-2026-117611?: Yes: fixed in Checkmk 2.5.0p18, 2.4.0p39, 2.3.0p52. Until then: Keep the operating system CA certificate store up to date. If using custom trusted certificate authorities, ensure they are properly configured in the site's SSL settings to override the bundled CA store.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-17", "note": "Mozilla received report of compromised eMudhra private keys" }, { "kind": "advisory", "at": "2026-10-29", "note": "CVE-2026-117611 published" }, { "kind": "patched", "at": "2026-10-23", "note": "Checkmk patches released removing untrusted eMudhra root CAs" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-117611 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-117611?: Check whether you run Checkmk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Checkmk 2.5.0p18, 2.4.0p39, 2.3.0p52

Keep the operating system CA certificate store up to date. If using custom trusted certificate authorities, ensure they are properly configured in the site's SSL settings to override the bundled CA store.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-17", "note": "Mozilla received report of compromised eMudhra private keys" }, { "kind": "advisory", "at": "2026-10-29", "note": "CVE-2026-117611 published" }, { "kind": "patched", "at": "2026-10-23", "note": "Checkmk patches released removing untrusted eMudhra root CAs" } ]

Technical details

Checkmk versions prior to 2.5.0p18, 2.4.0p39, and 2.3.0p52 bundle root CA certificates from the certifi library that included compromised eMudhra (emSign) intermediate certificates. An attacker possessing the disclosed private keys can issue forged certificates that will be accepted as valid by Checkmk's HTTP checks and agent updaters. This is a network-based attack requiring no authentication or user interaction, affecting all versions that use the vulnerable certifi package (≥2019.03.09 <2026.10.19).

Affected products

Checkmk Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52, 2.2.0 (EOL)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.