Is CVE-2026-14440 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14440 being exploited in the wild.

How severe is CVE-2026-14440?

Informational severity, with a CVSS score of 7.6, published 1 July 2026.

Which products and versions are affected?

Cloudflare Universal SSL All versions prior to July 2026.

Is there a fix for CVE-2026-14440?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-14440 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-14440?

Check whether you run Cloudflare Universal SSL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14440: Cloudflare Universal SSL CAA enforcement bypass

CVE-2026-14440 · Severity: info · CVSS 7.6 · Published 2026-07-01

Cloudflare's Universal SSL feature, which automatically manages security certificates for websites, contains a configuration flaw that can bypass certain advanced security restrictions set by customers. Specifically, if a customer tries to limit certificate issuance to a specific account or validation method, Cloudflare's automated system may override these settings with more permissive ones. This could theoretically allow a sophisticated attacker to obtain a fraudulent security certificate for a customer's domain, potentially allowing them to intercept or spoof encrypted web traffic.

Vendors: Cloudflare.

Quick answers

Is CVE-2026-14440 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14440 being exploited in the wild.
How severe is CVE-2026-14440?: Informational severity, with a CVSS score of 7.6, published 1 July 2026.
Which products and versions are affected?: Cloudflare Universal SSL All versions prior to July 2026.
Is there a fix for CVE-2026-14440?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14440 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-14440?: Check whether you run Cloudflare Universal SSL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Cloudflare's Universal SSL feature automatically manages Certificate Authority Authorization (CAA) Resource Record Sets (RRsets) for customer zones. This auto-managed RRset is designed to be permissive and takes precedence over customer-configured CAA records at query time. Consequently, when a customer attempts to implement stricter controls using RFC 8657 parameters (such as 'accounturi' or 'validationmethods'), these constraints are not observed by the Certificate Authority because the Cloudflare-served RRset lacks them. An attacker who controls an ACME account at a permitted CA and can satisfy domain control validation requirements could potentially obtain a browser-trusted certificate for the target domain. Mitigation requires disabling Universal SSL for zones where strict RFC 8657 enforcement is necessary.

Affected products

Cloudflare Universal SSL All versions prior to July 2026

Timeline

2026-07-01: disclosed: Vulnerability disclosed by Cloudflare and assigned CVE-2026-14440.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.