CVE-2026-28386 OpenSSL CVE debrief

Who should care

Users of OpenSSL FIPS module in version 3.6 on x86-64 systems with AVX-512 and VAES instruction support should review and apply patches to mitigate this vulnerability. This includes operators managing affected systems, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security and integrity of their systems.

Technical summary

The vulnerable code path is only reached when processing partial blocks (when a previous call left an incomplete block and the current call provides fewer bytes than needed to complete it). Additionally, the input buffer must be positioned at a page boundary with the following page unmapped. CFB mode is not used in TLS/DTLS protocols, which use CBC, GCM, CCM, or ChaCha20-Poly1305 instead. The issue was assessed as Low severity according to the Security Policy. However, users of affected systems should still prioritize patching to prevent potential crashes and Denial of Service. Affected product deployments exist in managed environments and require an owner for follow-up.

Defensive priority

This issue was assessed as Low severity according to the Security Policy. However, users of affected systems should still prioritize patching to prevent potential crashes and Denial of Service. It is recommended to review and apply patches from OpenSSL and monitor for potential crashes and Denial of Service. Consider compensating controls for systems that cannot be patched immediately. Inventory systems using OpenSSL FIPS module in version 3.6 and track exceptions, retest remediated assets, and close the item only after evidence is documented. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Review compensating controls for exposed systems while remediation is scheduled and verified. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Review compensating controls for exposed systems while remediation is scheduled and verified. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Review compensating controls for exposed systems while remediation is scheduled and verified. Check relevant monitoring, detection, and logs for

Recommended defensive actions

• Review and apply patches from OpenSSL
• Inventory systems using OpenSSL FIPS module in version 3.6
• Monitor for potential crashes and Denial of Service
• Consider compensating controls for systems that cannot be patched immediately
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The OpenSSL FIPS module in version 3.6 is affected by this issue. Only x86-64 systems with AVX-512 and VAES instruction support are affected. Other architectures and systems without VAES support use different code paths that are not affected. This information is based on the CVE record and vendor advisory from OpenSSL. Further verification is recommended to confirm affected scope and severity.

Official resources