# CVE-2026-25826: Keyfactor SignServer file content exposure in PKCS11CryptoToken

Source: https://junglewise.ai/threats/cve-2026-25826-keyfactor-signserver-file-content-exposure-in-pkcs11cryptotoken  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-25826 · Severity: medium · CVSS 4.9 · Published 2026-09-15

Keyfactor SignServer is an enterprise software solution used for cryptographic signing and digital certificate management. A vulnerability in its PKCS11CryptoToken component allows users with administrative access to inadvertently expose sensitive file contents by misconfiguring the ATTRIBUTESFILE attribute, which causes error messages containing file data to be logged. An attacker with both SignServer admin privileges and access to application server logs could read files accessible to the local JBoss user, potentially compromising cryptographic keys or other sensitive data.

Technologies: [Keyfactor SignServer](https://junglewise.ai/threats/technologies/signserver). Vendors: [Keyfactor](https://junglewise.ai/threats/vendors/keyfactor).

## Quick answers

**Is CVE-2026-25826 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25826 being exploited in the wild.

**How severe is CVE-2026-25826?** Medium severity, with a CVSS score of 4.9, published 15 September 2026.

**Which products and versions are affected?** Keyfactor SignServer before 7.6.0.

**Is there a fix for CVE-2026-25826?** A patch was published on 2026: Fixed in SignServer 7.6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25826 attacked?** It is attacked with local access, in a hosted service.

**Am I affected by CVE-2026-25826?** Check whether you run Keyfactor SignServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an information disclosure flaw in the PKCS11CryptoToken component of SignServer. When the ATTRIBUTESFILE attribute is set to a readable file that is not a valid PKCS11 attributes file, an error is thrown that logs the full contents of the file to the application server log. The attack requires two preconditions: SignServer admin access (to configure the token) and ability to read application server logs (feasible if remote syslog is configured). An attacker cannot directly trigger file reads but must rely on administrator misconfiguration or social engineering. The vulnerability was fixed in SignServer 7.6.0 and later versions.

## Affected products

- Keyfactor SignServer before 7.6.0

## Timeline

- 2026-09-15: disclosed: CVE-2026-25826 published
- 2026: patched: Fixed in SignServer 7.6.0

## References

- [https://keyfactor.com/](https://keyfactor.com/)
- [https://support.keyfactor.com/hc/en-us/articles/46345260842779-SignServer-CVE-2026-25826-Exposure-of-Sensitive-Information-to-an-Unauthorized-Actor](https://support.keyfactor.com/hc/en-us/articles/46345260842779-SignServer-CVE-2026-25826-Exposure-of-Sensitive-Information-to-an-Unauthorized-Actor)

## Related threats

- [Keyfactor SignServer local file enumeration via unrestricted properties](https://junglewise.ai/threats/cve-2026-25827-keyfactor-signserver-local-file-enumeration-via-unrestricted)
- [Keyfactor SignServer arbitrary file write in SignerStatusReportWorker](https://junglewise.ai/threats/cve-2026-25825-keyfactor-signserver-arbitrary-file-write-in)
- [An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2. The Admin…](https://junglewise.ai/threats/cve-2025-26787-an-error-in-the-signserver-container-startup-logic-was-found-in)
- [A class name enumeration was found in Keyfactor SignServer versions prior to 7.3.2. Setting any chosen class name to…](https://junglewise.ai/threats/cve-2025-47222-a-class-name-enumeration-was-found-in-keyfactor-signserver)
- [An arbitrary file write was found in Keyfactor SignServer versions prior to 7.3.2. The properties…](https://junglewise.ai/threats/cve-2025-47221-an-arbitrary-file-write-was-found-in-keyfactor-signserver)