CVE-2026-115881

CVE Enrichment

CISA KEV: Not listed

Last enrichment sync: 28-Oct-2026 04:37
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

Tracked as CVE-2026-115881, the flaw carries a vendor-assigned CVSS score of 9.1 and affects GoAhead versions 3.4.5 through 6.1.0 when the software uses its OpenSSL-compatible TLS backend with certificate revocation GoAhead TLS Flaw Lets Revoked Client Certificates Authenticate
The critical flaw, CVE-2026-115881 (CVSS score of 9.1), impacts GoAhead 3.4.5 through 6.1.0 when built with OpenSSL or a compatible library and configured for mutual TLS (mTLS) with a certificate revocation list (CRL). Three TLS Flaws in GoAhead Web Server Put Some Device Configurations at Risk
The identifier on the advisory is CVE-2026-115881, rated 9.1 by EmbedThis. As of October 27, that identifier and the others below were not yet live in the public CVE and NVD databases; EmbedThis says it has requested GoAhead 6.1.1 Fixes TLS Flaws and Login Bypass in Embedded Web Server

CVE (1)

People (2)

MITRE ATT&CK (1)

Vendors (1)

Products (4)

Tools (1)

Industries (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.