CVE-2026-25826 Keyfactor CVE debrief

Who should care

Defenders responsible for Keyfactor SignServer instances, particularly those with admin access and log monitoring capabilities, should verify inventory and prioritize upgrading to version 7.6.0 or later. They should also review compensating controls for exposed systems and monitor server logs for potential sensitive information exposure. Defenders should also focus on restricting log access and verifying affected versions and instance inventory. This may  

Why it matters

CVE-2026-25826 is a medium-severity vulnerability in Keyfactor SignServer that allows sensitive information exposure through server logs. Defenders should verify inventory, restrict log access, and prioritize upgrading to version 7.6.0 or later.

• Potential sensitive information exposure to unauthorized users with admin access and log monitoring capabilities
• Possible data leakage through server logs
• Need for verification of affected versions and instance inventory
• Priority on upgrading to version 7.6.0 or later

Technical summary

The ATTRIBUTESFILE attribute in PKCS11CryptoToken can be set to a readable file, causing an error that prints the file content to the application server log. This gives a user that has both SignServer admin access and access to read the output of the server log the possibility to read the content of files accessible by the local user JBoss. The vulnerability exists in Keyfactor SignServer before version 7.6.0, and defenders should prioritize verifying inventory and upgrading to version 7.6.0 or later. A user with SignServer admin access and access to server logs can read file content accessible by the local user JBoss.

Defensive priority

Defenders should prioritize verifying inventory and upgrading to version 7.6.0 or later.

Recommended defensive actions

• Verify inventory of Keyfactor SignServer instances
• Upgrade to version 7.6.0 or later
• Monitor server logs for potential sensitive information exposure
• Restrict access to server logs
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the exact scope of affected versions and potential impact require further verification. Defenders should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. They should also verify inventory of Keyfactor SignServer instances, particularly those with admin access and log monitoring capabilities.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.