CVE-2026-25827 Keyfactor CVE debrief

Who should care

Defenders responsible for Keyfactor SignServer deployments, especially those with admin user access, should assess exposure and prioritize verification to prevent potential information leaks.

Why it matters

CVE-2026-25827 is a low-severity vulnerability in Keyfactor SignServer that allows an admin user to potentially reveal information about file existence on the server. Defenders should assess exposure and prioritize verification of Keyfactor SignServer deployments, especially those with admin user access, to prevent potential information leaks.

• Potential information leak about file existence on the server
• Verification priority for Keyfactor SignServer deployments
• Need to restrict admin user access to sensitive properties

Technical summary

The vulnerability exists in Keyfactor SignServer before version 7.6.0, where an admin user can set specific properties to reveal information about file existence on the server. The affected properties are ATTRIBUTESFILE, KEYSTOREPATH, and TRUSTSTOREPATH. This allows an admin user to potentially reveal information about file existence on the server. Defenders should assess exposure and prioritize verification of Keyfactor SignServer deployments, especially those with admin user access, to prevent potential information leaks.

Defensive priority

Defenders should assess exposure and prioritize verification of Keyfactor SignServer deployments, especially those with admin user access, to prevent potential information leaks.

Recommended defensive actions

• Assess exposure of Keyfactor SignServer deployments, especially those with admin user access
• Verify server configurations for suspicious property settings
• Restrict admin user access to sensitive properties
• Monitor server logs for potential file enumeration attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 2.3 and the affected product. However, specific version details and remediation steps are limited. The vulnerability allows an admin user to potentially reveal information about file existence on the server through specific property settings. The affected properties are ATTRIBUTESFILE, KEYSTOREPATH, and TRUSTSTOREPATH. Defenders should assess exposure and prioritize verification of Keyfactor SignServer deployments, especially those withadmin

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.