Is CVE-2026-16000 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16000 being exploited in the wild.

How severe is CVE-2026-16000?

Informational severity, published 2 October 2026.

Which products and versions are affected?

Legion of the Bouncy Castle Inc. Bc-Csharp before 2.7.0.

Is there a fix for CVE-2026-16000?

Yes: fixed in 2.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-16000 attacked?

It is attacked over the network.

Am I affected by CVE-2026-16000?

Check whether you run Legion of the Bouncy Castle Inc. Bc-Csharp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16000: Bouncy Castle DSTU 7624 CCM authentication bypass with missing nonce binding

CVE-2026-16000 · Severity: info · Published 2026-10-02

Bouncy Castle for .NET is a cryptography library used by applications to encrypt and authenticate data. The DSTU 7624 CCM encryption mode has a flaw where it does not properly bind the nonce (a unique value per encryption) to the authentication tag when no associated data is present, allowing an attacker to forge valid ciphertexts for different nonces. Applications that directly use the affected component and do not use associated data are vulnerable to tag forgery and message tampering.

Technologies: Legion of the Bouncy Castle Inc. Bc-Csharp. Vendors: Legion of the Bouncy Castle Inc..

Quick answers

Is CVE-2026-16000 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16000 being exploited in the wild.
How severe is CVE-2026-16000?: Informational severity, published 2 October 2026.
Which products and versions are affected?: Legion of the Bouncy Castle Inc. Bc-Csharp before 2.7.0.
Is there a fix for CVE-2026-16000?: Yes: fixed in 2.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16000 attacked?: It is attacked over the network.
Am I affected by CVE-2026-16000?: Check whether you run Legion of the Bouncy Castle Inc. Bc-Csharp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.7.0

Technical details

The KCcmBlockCipher implementation in DSTU 7624 CCM mode omits the G1 block processing—which binds the nonce, message length, and MAC-size flag into the CBC-MAC—when no associated data (AAD) is supplied. This causes the authentication tag to depend only on the plaintext, not the nonce, enabling a chosen-plaintext attacker to forge valid ciphertexts across different nonces by reusing keystreams. The fix unconditionally processes the G1 block and gates the AAD absorption based on actual AAD length.

Affected products

Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0

Timeline

2026-10-02: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.