CVE-2026-82356

Imprivata Enterprise Access Management (EAM) versions 26.2.6 and earlier generate an X.509 certificate from an RSA key pair that cannot be rotated after deployment, so the same long-lived key is used indefinitely. This is a key-management weakness rather than a flaw an attacker triggers directly: the impact materializes if the private key is ever compromised through a separate intrusion, side-channel, or future cryptanalytic advance. An attacker who obtains the key can forge or spoof the certificate indefinitely, enabling impersonation of the EAM service or man-in-the-middle interception of sessions that trust it, with no clean rotation path to invalidate the stolen key. Affected parties are organizations running Imprivata EAM 26.2.6 or older, which Imprivata deploys primarily in healthcare settings such as hospitals and health systems. There is no CVSS score yet, no public proof of concept, and no known exploitation in the wild.

What to do: Plan an upgrade to an Imprivata EAM release later than 26.2.6 once the vendor ships key-rotation support, and track CERT advisory VU#273940 for fixed-version details. In the meantime, treat the appliance's RSA private key as high-value: harden and restrict access to the EAM server and its key store, segment it from general networks, and monitor logs and certificate transparency or trust stores for any unexpected certificates matching the deployment's key. If key compromise is suspected, engage Imprivata support immediately, since in-place rotation is not possible on affected versions.