High severity · published Sep 23, 2026
CVE-2026-82356
Imprivata EAM: Unrotatable X.509 RSA Key Pair in Production
7.5
CVSS
0.1%
EPSS
No
On KEV
Description
Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IE
Imprivata Enterprise Access Management · Imprivata
0.0.0 through 26.2.6 · source: vendor
Affected product
IE
Imprivata Enterprise Access Management
Imprivata