CVE-2026-1858 in wget2

Résumé

par MITRE • 30/04/2026

wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Responsable: Tenable
• Réserver: 03/02/2026
• Divulgation: 30/04/2026
• Modérer: accepté
• Entrée: VDB-360223
• CPE: prêt
• CWE: CWE-295 (confirmé)
• CVSS: 4.8 (CNA)
• EPSS: 0.00011
• KEV: non
• Activités: très faible
• Secteur: Government, Industry, ...

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-1858
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-1858
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-1858/