What’s Vulnerable › Vulnerabilities

CVE-2026-81701: openssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-27 · updated 2026-09-01
• Weakness: CWE-347

Description

openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths to achieve arbitrary code execution in the CLI process with access to passwords and cryptographic keys.

Affected products

• jahlives openssl_encrypt: before 1.4.9 — fixed in 1.4.9

How to fix

Upgrade to a fixed version: jahlives openssl_encrypt 1.4.9. Check the vendor advisory for mitigations.

References

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-wxx9-p55f-wm34
• https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-arbitrary-code-execution-via-unsigned-plugin

Get alerted when CVE-2026-81701 or the next vulnerability affects your stack