Is CVE-2026-28390 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28390 being exploited in the wild.

How severe is CVE-2026-28390?

High severity, with a CVSS score of 7.5, published 7 April 2026.

Which products and versions are affected?

Siemens SIMATIC CN 4100 before V5.0.

Is there a fix for CVE-2026-28390?

A patch was published on 2026-04-06: Fixes committed to OpenSSL repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-28390 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-28390?

Check whether you run Siemens SIMATIC CN 4100 or Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28390: OpenSSL NULL pointer dereference in CMS EnvelopedData processing

CVE-2026-28390 · Severity: high · CVSS 7.5 · Published 2026-04-07

OpenSSL is a widely used security library that enables encrypted communications for websites, email, and corporate tools. A vulnerability has been identified where a specially crafted encrypted message can cause applications using OpenSSL to crash. This results in a denial-of-service, potentially disrupting secure communications or crashing services like S/MIME email processing before they can even verify the sender's identity.

Technologies: Siemens SIMATIC CN 4100, Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem. Vendors: Siemens.

Quick answers

Is CVE-2026-28390 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28390 being exploited in the wild.
How severe is CVE-2026-28390?: High severity, with a CVSS score of 7.5, published 7 April 2026.
Which products and versions are affected?: Siemens SIMATIC CN 4100 before V5.0.
Is there a fix for CVE-2026-28390?: A patch was published on 2026-04-06: Fixes committed to OpenSSL repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28390 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-28390?: Check whether you run Siemens SIMATIC CN 4100 or Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A NULL pointer dereference exists in OpenSSL's CMS (Cryptographic Message Syntax) implementation, specifically within the rsa_cms_decrypt function in crypto/cms/cms_rsa.c. When processing a CMS EnvelopedData message using KeyTransportRecipientInfo with RSA-OAEP encryption, the code fails to verify the presence of the optional parameters field in the RSA-OAEP SourceFunc algorithm identifier. An unauthenticated remote attacker can exploit this by sending a malformed CMS message, causing the application to crash during the call to CMS_decrypt(). This affects various protocols relying on CMS, such as S/MIME. The issue is resolved in OpenSSL versions 3.6.2, 3.5.6, 3.4.5, 3.3.7, 3.0.20, and 1.1.1zg.

Affected products

OpenSSL OpenSSL 3.6.0 to 3.6.1, 3.5.0 to 3.5.5, 3.4.0 to 3.4.4, 3.3.0 to 3.3.6, 3.0.0 to 3.0.19, 1.1.1 to 1.1.1zf
Siemens SIMATIC CN 4100 before V5.0
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Timeline

2026-04-06: patched: Fixes committed to OpenSSL repository
2026-04-07: advisory: OpenSSL Security Advisory published
2026-04-07: disclosed: CVE-2026-28390 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.