Orgs at Risk: Privasys ra-tls-clients TLS Spoofing Flaw Patched in v0.11.0

Organisations relying on Privasys Remote Attestation TLS Clients face a critical risk of endpoint impersonation. The vulnerability, tracked as CVE-2026-108362, carries a CVSS score of 9.1. It affects all software versions released before 0.11.0. Attackers can exploit this flaw to bypass security checks designed to verify the integrity of trusted execution environments.

How it unfolded

• Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested connections.
• Prior to version 0.11.0, the software accepted TEE attestation evidence without requiring an explicitly authorised platform identity.
• This lack of strict identity verification allowed verifiers to accept valid measurements from different unrevoked TEE platforms as if they originated from the intended attester.

Who is affected

The issue impacts any organisation using Privasys ra-tls-clients versions earlier than 0.11.0. According to the National Vulnerability Database, the weakness falls under CWE-346, which relates to origin verification errors. The flaw is particularly dangerous for systems that depend on remote attestation to establish trust in TLS connections. If an attacker can forge evidence or extract secrets from a compromised but unrevoked platform, they can successfully impersonate the legitimate endpoint.

The fix

Privasys has released version 0.11.0, which resolves the vulnerability. The update enforces the requirement for an explicitly authorised platform identity during the attestation process. This change ensures that the verifier rejects measurements that do not match the specific intended attester, even if the measurements are technically valid for another unrevoked platform. Users must upgrade to this version to mitigate the risk of impersonation attacks.

What to do and how to stay safe: Privasys

• Audit your infrastructure to identify all instances of Privasys ra-tls-clients and check their current version numbers.
• Prioritise upgrading any installations running versions prior to 0.11.0 to the patched release as soon as possible.
• Review logs for anomalous attestation evidence or unexpected platform identities that may indicate active exploitation.
• Implement network segmentation to limit the ability of attackers to intercept or forge attestation traffic.

Step-by-step guide: Patch Management: Eight Questions Answered for Stability

General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-108362?

It is a critical vulnerability in Privasys ra-tls-clients that allows attackers to impersonate TLS endpoints by bypassing platform identity checks.

Which versions are affected?

All versions of Privasys ra-tls-clients prior to 0.11.0 are affected by this flaw.

Is there a fix available?

Yes, the issue is fixed in version 0.11.0, which enforces explicit platform identity authorisation.