Is CVE-2026-77696 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77696 being exploited in the wild.

How severe is CVE-2026-77696?

Low severity, with a CVSS score of 3.7, published 29 September 2026.

Which products and versions are affected?

OpenSSL versions prior to fix commits 1c4aed8 and 20b2062.

Is there a fix for CVE-2026-77696?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-77696 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-77696?

Check whether you run OpenSSL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77696: OpenSSL SM2 signature generation timing side-channel

CVE-2026-77696 · Severity: low · CVSS 3.7 · Published 2026-09-29

OpenSSL's SM2 digital signature implementation leaks information about secret signing keys through variations in the time it takes to generate signatures. An attacker with the ability to measure signing times across many operations could potentially recover the private cryptographic key, compromising the security of systems that rely on SM2 for digital signatures and authentication.

Technologies: OpenSSL. Vendors: OpenSSL.

Quick answers

Is CVE-2026-77696 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77696 being exploited in the wild.
How severe is CVE-2026-77696?: Low severity, with a CVSS score of 3.7, published 29 September 2026.
Which products and versions are affected?: OpenSSL versions prior to fix commits 1c4aed8 and 20b2062.
Is there a fix for CVE-2026-77696?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-77696 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-77696?: Check whether you run OpenSSL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The SM2 signature generation function performs variable-time arithmetic on secret values (the nonce and private key) using BIGNUM operations, creating a timing side-channel. An attacker with the ability to measure signing latencies can exploit this to learn information about the per-signature nonce; over many signatures, lattice-based attacks (Hidden Number Problem) can recover the private key. The vulnerability affects all platforms where OpenSSL performs SM2 signing.

Affected products

OpenSSL OpenSSL versions prior to fix commits 1c4aed8 and 20b2062

Timeline

2026-09-29: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.