CVE-2026-52723 fbeta-GmbH CVE debrief

Who should care

Defenders of systems using ePA 3.x Integration, especially those in Germany's electronic patient record system, should assess exposure and prioritize upgrading to version 1.3.0. This involves reviewing the current deployment of ePA 3.x Integration, identifying potential vulnerabilities, and implementing necessary updates or mitigations. Additionally, defenders should verify VAU server certificate validation and TLS certificate verification, and monitor for

Why it matters

CVE-2026-52723 allows a network-positioned attacker to impersonate the VAU server and control encrypted traffic due to improper certificate validation and disabled TLS verification in ePA 3.x Integration prior to version 1.3.0. Defenders of systems using ePA 3.x Integration should assess exposure and prioritize upgrading to version 1.3.0.

• Impersonation of VAU server by a network-positioned attacker
• Control of negotiated session keys by an attacker
• Reading or modification of encrypted VAU traffic by an attacker
• Verification of certificate validation and TLS certificate verification in ePA 3.x Integration systems

Technical summary

ePA 3.x Integration prior to version 1.3.0 performs VAU server certificate validation without anchoring the signed_vau_server_pub_keys and AUT_VAU_CertData certificate path to independent trusted material. A network-positioned attacker can intercept the VAU handshake, supply attacker-controlled certificate and key material, and satisfy the circular trust relationship. TLS certificate verification is also disabled in affected versions.

Defensive priority

High priority for systems using ePA 3.x Integration, especially those in Germany's electronic patient record system, to upgrade to version 1.3.0 and verify certificate validation.

Recommended defensive actions

• Upgrade ePA 3.x Integration to version 1.3.0 or later
• Verify VAU server certificate validation and TLS certificate verification
• Monitor for suspicious VAU traffic and session key activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source references indicate a critical vulnerability in ePA 3.x Integration prior to version 1.3.0. The issue is related to improper VAU server certificate validation and disabled TLS certificate verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.