Is CVE-2026-25827 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25827 being exploited in the wild.

How severe is CVE-2026-25827?

Low severity, with a CVSS score of 2.3, published 15 September 2026.

Which products and versions are affected?

Keyfactor SignServer before 7.6.0.

Is there a fix for CVE-2026-25827?

A patch was published on 2026: Fixed in SignServer 7.6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25827 attacked?

It is attacked with local access, in a hosted service.

Am I affected by CVE-2026-25827?

Check whether you run Keyfactor SignServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25827: Keyfactor SignServer local file enumeration via unrestricted properties

CVE-2026-25827 · Severity: low · CVSS 2.3 · Published 2026-09-15

Keyfactor SignServer is a PKI/code-signing solution used by enterprises to manage digital certificates and cryptographic operations. An administrative user can misconfigure three file path properties (ATTRIBUTESFILE, KEYSTOREPATH, TRUSTSTOREPATH) to probe the server's filesystem and determine whether specific files exist, potentially exposing sensitive information about the system configuration and file structure to clients.

Technologies: Keyfactor SignServer. Vendors: Keyfactor.

Quick answers

Is CVE-2026-25827 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25827 being exploited in the wild.
How severe is CVE-2026-25827?: Low severity, with a CVSS score of 2.3, published 15 September 2026.
Which products and versions are affected?: Keyfactor SignServer before 7.6.0.
Is there a fix for CVE-2026-25827?: A patch was published on 2026: Fixed in SignServer 7.6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25827 attacked?: It is attacked with local access, in a hosted service.
Am I affected by CVE-2026-25827?: Check whether you run Keyfactor SignServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a local file enumeration flaw affecting three properties in SignServer's cryptographic token implementations: ATTRIBUTESFILE in PKCS11CryptoToken, KEYSTOREPATH in KeyStoreCryptoToken, and TRUSTSTOREPATH in RenewalWorker. The root cause is insufficient input validation on file path properties, allowing an authenticated admin to set these paths without restrictions. When a misconfigured path is used, the application returns error messages that confirm file existence or non-existence, enabling an attacker with admin privileges to enumerate the filesystem. This requires administrative access to the application and does not directly compromise cryptographic keys or sign operations. The vulnerability was patched in SignServer 7.6.0.

Affected products

Keyfactor SignServer before 7.6.0

Timeline

2026-09-15: disclosed
2026: patched: Fixed in SignServer 7.6.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.