Attributed metadata history
Up to 100 retained publisher events per page for 53d56f046150ea6563a9acbd2af168e8cc15f49109c9dd9c7718d700a961d08e. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_cd638cf167c7c119d6
observed · 2026-10-12 15:23:03 UTC
Overview Imprivata Enterprise Access Management (EAM), an authentication and single sign-on platform for enterprise and clinical environments, contains a vulnerability in versions 26.2.6 and below. The product provides no supported mechanism to rotate its RSA key pair after deployment, meaning the same key pair is used indefinitely to generate the appliance's X.509 certificate. Description CVE-2026-82356 Imprivata EAM uses an RSA key pair to generate the X.509 certificate that identifies the appliance to the clinical workstations, Electronic Health Record (EHR) platforms, and shared-device workflows that rely on it for authentication. After reviewing the product documentation and engaging Imprivata support, it was confirmed that no supported mechanism exists to rotate this RSA key pair after deployment. Using a single RSA key pair indefinitely for certificate generation violates cryptographic best practices. Because the key cannot be rotated, an attacker who obtains the private key retains a valid, trusted appliance identity for as long as the deployment remains in service, with no supported means to revoke or replace it short of redeploying the product. Impact An attacker who obta
Fingerprint: fa5e6b9c001199539c526c371a237ab536c3bcc35c128bb6072a2958d613870a
intelligence_src_cd638cf167c7c119d6
observed · 2026-10-12 15:23:03 UTC
available
Fingerprint: e9e546feaa1a197f9c3a53bee19e29f6899cd295cb68e67b1de5b309ac3481e8