CVE-2026-81701
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
Aug 27, 2026
Vendor
unknown
Description
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths to achieve arbitrary code execution in the CLI process with access to passwords and cryptographic keys.