CVE-2026-6899: S2OPC CycloneCrypto CRL Bypass Vulnerability

CVE-2026-6899 Overview

CVE-2026-6899 is a certificate revocation validation flaw in the CycloneCrypto cryptographic wrapper of the S2OPC library. The wrapper checks only the first matching Certificate Revocation List (CRL) for a given Certificate Authority (CA) and ignores other valid CRLs from the same CA. As a result, an OPC UA client and server can establish a connection using a revoked certificate. The issue is tracked as [CWE-299: Improper Check for Certificate Revocation] and affects industrial automation deployments that rely on S2OPC for secure OPC UA communications.

Critical Impact
Revoked certificates may be accepted as valid, allowing trust relationships to persist after a CA has explicitly revoked credentials.

Affected Products

S2OPC library — OPC UA implementation by Systerel
CycloneCrypto cryptographic wrapper within S2OPC
OPC UA clients and servers built using the affected S2OPC builds

Discovery Timeline

2026-06-09 - CVE-2026-6899 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-6899

Vulnerability Analysis

The S2OPC library implements the OPC UA protocol for industrial automation and integrates with the CycloneCrypto library for cryptographic operations. During certificate validation, the CycloneCrypto wrapper iterates over CRLs associated with a CA to determine whether a presented certificate has been revoked. The wrapper terminates the search at the first CRL that matches the issuer, regardless of whether that CRL contains the relevant revocation entry. Additional CRLs issued by the same CA, including newer or supplemental CRLs that list the revoked serial number, are never consulted.

The outcome is a certificate revocation check that returns success even when the certificate has been revoked by the issuing CA. An attacker who controls a previously trusted but revoked certificate, for example through a compromised endpoint whose credentials were rotated, can present that certificate to an OPC UA peer and complete the handshake. Because OPC UA sessions carry process-control telemetry and commands, accepting a revoked certificate undermines a primary trust assumption of the protocol.

Root Cause

The root cause is incomplete iteration logic in the CRL lookup path of the CycloneCrypto wrapper. The code assumes a single CRL per CA is sufficient, which conflicts with CA deployments that publish multiple CRLs, such as base and delta CRLs or CRLs partitioned by issuance window. The defect maps to [CWE-299].

Attack Vector

Exploitation requires network access to an OPC UA endpoint and possession of a certificate that the CA has revoked but that is listed only in a non-first CRL. Attack complexity is high because the attacker must obtain a usable revoked certificate and the target CA must publish multiple CRLs. No privileges or user interaction are required. See the S2OPC GitLab Work Item #1739 for upstream tracking.

Detection Methods for CVE-2026-6899

Indicators of Compromise

OPC UA session establishment events using a certificate serial number present in any CRL issued by the trusted CA
Repeated connection attempts from peers whose certificates were rotated or decommissioned
Mismatches between the active CRL set in the CA distribution point and the CRL files loaded by S2OPC processes

Detection Strategies

Compare the certificate serial numbers observed in OPC UA handshakes against the union of all CRLs published by each trusted CA, not just the first.
Audit S2OPC PKI directories for cases where multiple CRLs exist for the same issuer and verify that all are evaluated.
Alert on successful sessions whose peer certificate appears in any locally cached CRL.

Monitoring Recommendations

Log all OPC UA session establishments including peer certificate fingerprint, issuer, and serial number.
Continuously poll CA CRL distribution points and reconcile against revocation decisions made by S2OPC endpoints.
Track changes to the revoked and trusted PKI directories used by S2OPC for unexpected additions or removals.

How to Mitigate CVE-2026-6899

Immediate Actions Required

Inventory all deployments that embed the S2OPC library and identify the CycloneCrypto build path.
Consolidate CRLs for each trusted CA into a single, authoritative CRL file so that the first-match logic evaluates the complete revocation set.
Rotate certificates issued by CAs that maintain multiple CRLs and reissue under a CA that publishes a single consolidated CRL until a patched build is available.

Patch Information

A fix is tracked upstream in S2OPC GitLab Work Item #1739. Operators should monitor the Systerel S2OPC repository for a release that iterates over all CRLs matching the issuing CA during revocation checks and rebuild any embedded products against the patched library.

Workarounds

Configure trusted CAs to publish a single merged CRL rather than multiple partitioned CRLs.
Reduce certificate lifetimes so revocation is less frequently required for affected endpoints.
Restrict OPC UA endpoints to network segments protected by additional authentication controls until the library is patched.

bash

# Configuration example: merge multiple CRLs into a single PEM bundle
# so the first-match lookup in the CycloneCrypto wrapper evaluates all entries
cat ca-crl-base.pem ca-crl-delta.pem > /etc/s2opc/pki/revoked/ca-merged.crl.pem
chmod 0644 /etc/s2opc/pki/revoked/ca-merged.crl.pem
rm /etc/s2opc/pki/revoked/ca-crl-base.pem /etc/s2opc/pki/revoked/ca-crl-delta.pem
systemctl restart s2opc-server