CVE-2026-15999

Improper validation of integrity check value in the AES-CCM implementation (CcmParameters and CcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to modify CCM-encrypted content without detection via an AlgorithmIdentifier whose CCMParameters declare an authentication tag (aes-ICVlen) of zero or another length outside the RFC 5084 set, because CcmParameters accepted any value and CcmBlockCipher validated the tag length only when encrypting, so decryption compared a zero-length or very short tag. Affected paths include ParameterUtilities.GetCipherParameters, used by CmsEnvelopedData and CmsEnvelopedDataParser for EnvelopedData encrypted with AES-CCM, and any caller passing an unchecked tag length to CcmBlockCipher for decryption.

• CWE-354

• https://github.com/bcgit/bc-csharp/commit/2818bdfa55efd58b0d6a1c75f360b8404d879780Patch
• https://github.com/bcgit/bc-csharp/commit/9d284d8f379614def853b590c62bbb31c48f7af0Patch
• https://github.com/bcgit/bc-csharp/wiki/CVE-2026-15999Patch, Vendor Advisory

Published

Oct 2, 2026

Last Modified

Oct 27, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15992The WP Password Policy plugin for WordPress is vulnerable to…8.8
• CVE-2026-15993The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contac…5.3
• CVE-2026-15994During an internal security assessment, an improper link fol…7
• CVE-2026-15995IBM Cognos Analytics 12.1.3 GA Version with build number thr…4.2
• CVE-2026-15996A denial of service vulnerability was identified in GitHub E…7.5
• CVE-2026-15997Out-of-bounds write vulnerability in Legion of the Bouncy Ca…1.7
• CVE-2026-1600A vulnerability was identified in Bdtask Bhojon All-In-One R…4.3
• CVE-2026-16000Missing cryptographic step in the DSTU 7624 CCM mode impleme…7.5
• CVE-2026-16001Exposure of the message authentication key through the encry…7.5
• CVE-2026-16002The affected product is vulnerable to an Out-of-bounds read,…8.2
• CVE-2026-16003Exposed IOCTL with Insufficient Access Control in Armoury Cr…2
• CVE-2026-16004Exposed IOCTL with Insufficient Access Control in Armoury Cr…5.9