Quick answers
- Is CVE-2026-88823 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-88823 being exploited in the wild.
- How severe is CVE-2026-88823?
- Informational severity, published 10 November 2026.
- Which products and versions are affected?
- OpenSSL <UNKNOWN>.
- Is there a fix for CVE-2026-88823?
- Yes: fixed in <UNKNOWN>. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-88823 attacked?
- It is attacked over the network or with local access, in a software library.
- Am I affected by CVE-2026-88823?
- Check whether you run OpenSSL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: <UNKNOWN>
Technical details
The AES-GCM-SIV cipher in OpenSSL's default provider treats zero-length AAD updates as a reset operation, discarding previously accumulated AAD. Additionally, when the cipher context is re-initialized with a new key or nonce, stale AAD from prior operations is not cleared, causing it to be incorrectly included in the new message's authentication tag. An attacker can exploit this to forge or manipulate AAD in encrypted messages. The vulnerability is in the default provider only; FIPS modules are unaffected.
Affected products
- OpenSSL OpenSSL <UNKNOWN>
Timeline
- 2026-11-10: disclosed