Is CVE-2026-69247 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-69247 being exploited in the wild.

How severe is CVE-2026-69247?

High severity, with a CVSS score of 4, published 3 August 2026.

Which products and versions are affected?

cryptography (PyPI) >= 44.0.0, < 50.0.0, ECOSYSTEM:introduced=44.0.0,fixed=50.0.0.

Is there a fix for CVE-2026-69247?

Yes. cryptography (PyPI): upgrade to 50.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-69247 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-69247?

Check whether you run cryptography (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-69247: pyca cryptography Bleichenbacher oracle in PKCS#7 decryption

Q: Is there a fix for CVE-2026-69247?

Yes. cryptography (PyPI): upgrade to 50.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-69247 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-69247?

Check whether you run cryptography (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-69247 · Severity: high · CVSS 4 · Published 2026-08-03

A vulnerability in the 'cryptography' Python library could allow an attacker to decrypt sensitive data without knowing the correct password or key. This affects systems that automatically process encrypted emails or files, such as secure email gateways. If exploited, an attacker could eventually recover the secret keys used to protect corporate communications.

Technologies: cryptography (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-69247 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-69247 being exploited in the wild.
How severe is CVE-2026-69247?: High severity, with a CVSS score of 4, published 3 August 2026.
Which products and versions are affected?: cryptography (PyPI) >= 44.0.0, < 50.0.0, ECOSYSTEM:introduced=44.0.0,fixed=50.0.0.
Is there a fix for CVE-2026-69247?: Yes. cryptography (PyPI): upgrade to 50.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69247 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-69247?: Check whether you run cryptography (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

cryptography (PyPI): upgrade to 50.0.0 or later
```
pip install "cryptography>=50.0.0"
```

Technical details

The functions pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime fail to implement RFC 3218 mitigations, leading to a Bleichenbacher oracle. The implementation leaks information through distinguishable error messages and timing differences during the RSA PKCS#1 v1.5 decryption of the 'encryptedKey' field. Specifically, the library distinguishes between invalid RSA padding, incorrect key lengths, and padding errors in the subsequent AES-CBC decryption. This allows a remote attacker to perform a chosen-ciphertext attack to recover the content-encryption key. The vulnerability is fixed in version 50.0.0 by ensuring all decryption paths perform identical work and return uniform error responses.

Affected products

pyca cryptography >= 44.0.0, < 50.0.0

Identifiers

CVE-2026-69247
GHSA-g6cj-pr64-35w5
PYSEC-2026-3552

Timeline

2026-07-31: disclosed
2026-08-03: advisory
2026-08-03: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.