VU#273940: Enterprise Access Management EAM does not rotate RSA keys
Imprivata EAM 26.2.6 and earlier cannot rotate its RSA key, enabling persistent impersonation after key theft.
CERT/CC published VU#273940 for CVE-2026-82356 in Imprivata Enterprise Access Management versions 26.2.6 and below. The clinical and enterprise SSO platform has no supported way to rotate the RSA key pair used to generate its X.509 appliance certificate, so the same key is used indefinitely. An attacker who obtains the private key through backup exfiltration, a hypervisor snapshot, or filesystem access can impersonate the appliance and intercept SSO tokens, session assertions, and EHR credentials until the product is redeployed. Imprivata is tracking the issue internally, but no fix or timeline has been provided; CERT/CC advises restricting key access and enforcing perfect forward secrecy.
- CVE-2026-82356 affects Imprivata EAM 26.2.6 and earlier.
- No supported mechanism exists to rotate the appliance RSA key pair.
- A stolen private key allows persistent impersonation of the appliance.
- Compromise could expose SSO tokens and EHR credentials.
- Imprivata has published no fix or remediation timeline.
- CVEs
- CVE-2026-82356
- Vendors
- Imprivata
- Products
- Enterprise Access Management
- Organizations
- CERT/CC
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82356 | Non-rotatable RSA Key Pair in Imprivata Enterprise Access Management (EAM) <=26.2.6 | 7.5 | — |
From the original article
2 min read at kb.cert.orgOverview Imprivata Enterprise Access Management (EAM), an authentication and single sign-on platform for enterprise and clinical environments, contains a vulnerability in versions 26. 2. 6 and below.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.