CVE-2026-18717: Improper Certificate Validation in ASE 2000

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-28 · updated 2026-08-31
Weakness: CWE-295

Description

ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications.

Affected products

Applied Systems Engineering ASE2000 V2: from 2.25 through 2.37

References

http://www.ase-systems.com
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-239-04.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-04

Get alerted when CVE-2026-18717 or the next vulnerability affects your stack