CVE-2026-111943ModerateNetworkRevised 1 Nov

Go: CVE-2026-111943 Distrust compromised intermediate certificates in crypto/x509

MSRC advisory NVD CVE.org

Assessment

Severity: Moderate
CVSS base score: 7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U
Impact: Not stated
EPSS · 30-day forecast: No EPSS score collected
Public detection template: No Nuclei template is listed in the current collected catalog
Exploitation detected: Unknown: not stated by MSRC
Exploitability: Not assessed
Publicly disclosed: Unknown: not stated by MSRC
Customer action: Required: follow the MSRC remediation guidance
Component: Mariner
Weakness: —
Issued by: Go
Published: 28 Oct 2026 · October 2026
Last revised: 1 Nov 2026Information published.

CVSS 3.1 base metricsRed raises the risk · green lowers it

Attack vector: NetworkAV:N
Attack complexity: HighAC:H
Privileges required: NonePR:N
User interaction: NoneUI:N
Scope: UnchangedS:U
Confidentiality: HighC:H
Integrity: HighI:H
Availability: NoneA:N

Updates that fix it

0 KBs

No KB listed

No KB update is listed in the collected MSRC record. Check the MSRC advisory for product releases and other remedies.

Affected products

Open Source Software

4 affected products

azl3 golang 1.26.10-1 on Azure Linux 3.0
azl3 golang 1.26.7-1 on Azure Linux 3.0
azl3 golang 1.27.1-1 on Azure Linux 3.0
azl3 golang 1.27.3-1 on Azure Linux 3.0

What changed

Detection template: Unknown: detection-template evidence is incomplete or retained → No Nuclei template listed
6 Nov 2026 · 17:32:22 UTC
Detection template: No Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
6 Nov 2026 · 16:31:02 UTC
Detection template: Unknown: detection-template evidence is incomplete or retained → No Nuclei template listed
2 Nov 2026 · 17:30:39 UTC
Detection template: No Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
2 Nov 2026 · 16:27:39 UTC
Affected products: azl3 golang 1.26.7-1 on Azure Linux 3.0, azl3 golang 1.27.1-1 on Azure Linux 3.0 → azl3 golang 1.26.10-1 on Azure Linux 3.0, azl3 golang 1.26.7-1 on Azure Linux 3.0, azl3 golang 1.27.1-1 on Azure Linux 3.0, azl3 golang 1.27.3-1 on Azure Linux 3.0
2 Nov 2026 · 09:04:36 UTC
Affected products: azl3 golang 1.26.7-1 on Azure Linux 3.0 → azl3 golang 1.26.7-1 on Azure Linux 3.0, azl3 golang 1.27.1-1 on Azure Linux 3.0
1 Nov 2026
Detection template: No Nuclei template listed · Affected products: azl3 gcc 13.2.0-7 on Azure Linux 3.0, azl3 golang 1.26.7-1 on Azure Linux 3.0, azl3 golang 1.27.1-1 on Azure Linux 3.0, azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0, azl3 tensorflow 2.16.1-11 on Azure Linux 3.0 → azl3 golang 1.26.7-1 on Azure Linux 3.0 · Customer action: Required: apply the update → Required: follow the MSRC remediation guidance · Public disclosure: No → Unknown: not stated by MSRC · Exploitation detected: Not reported by MSRC → Unknown: not stated by MSRC · CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N → CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U · Severity: Important → Moderate
31 Oct 2026
Title changed
24 Oct 2026
Detection template: Unknown: exploit-code evidence is incomplete or retained → No Nuclei template listed · CISA KEV: Unknown: catalog evidence is incomplete or retained → Not listed in the collected catalog
23 Oct 2026 · 09:33:49 UTC
Detection template: No Nuclei template listed → Unknown: exploit-code evidence is incomplete or retained · CISA KEV: Not listed in the collected catalog → Unknown: catalog evidence is incomplete or retained
23 Oct 2026 · 08:31:50 UTC

Page history

Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.

Cite this version

Field-level log (46)

Up to 100 recent field edits are shown; older edits may be outside retention.

6 Nov 2026 · 17:32:22 UTC Public detection templateUnknown: detection-template evidence is incomplete or retained → No Nuclei template listed
6 Nov 2026 · 17:32:22 UTC Source coverage: public-exploit-codeIncomplete → Current
6 Nov 2026 · 17:32:22 UTC Source coverage: first-epssIncomplete → Current
6 Nov 2026 · 17:32:22 UTC Source coverage: msrc-cvrfIncomplete → Current
6 Nov 2026 · 16:31:02 UTC Public detection templateNo Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
6 Nov 2026 · 16:31:02 UTC Source coverage: public-exploit-codeCurrent → Incomplete
6 Nov 2026 · 16:31:02 UTC Source coverage: first-epssCurrent → Incomplete
6 Nov 2026 · 16:31:02 UTC Source coverage: msrc-cvrfCurrent → Incomplete
2 Nov 2026 · 17:30:39 UTC Public detection templateUnknown: detection-template evidence is incomplete or retained → No Nuclei template listed
2 Nov 2026 · 17:30:39 UTC Source coverage: public-exploit-codeIncomplete → Current
2 Nov 2026 · 17:30:39 UTC Source coverage: first-epssIncomplete → Current
2 Nov 2026 · 17:30:39 UTC Source coverage: msrc-cvrfIncomplete → Current
2 Nov 2026 · 16:27:39 UTC Public detection templateNo Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
2 Nov 2026 · 16:27:39 UTC Source coverage: public-exploit-codeCurrent → Incomplete
2 Nov 2026 · 16:27:39 UTC Source coverage: first-epssCurrent → Incomplete
2 Nov 2026 · 16:27:39 UTC Source coverage: msrc-cvrfCurrent → Incomplete
2 Nov 2026 · 09:04:36 UTC Last revised1 Nov 2026 02:44 UTC → 1 Nov 2026 14:54 UTC
2 Nov 2026 · 09:04:36 UTC Affected productsazl3 golang 1.26.7-1 on Azure Linux 3.0, azl3 golang 1.27.1-1 on Azure Linux 3.0 → azl3 golang 1.26.10-1 on Azure Linux 3.0, azl3 golang 1.26.7-1 on Azure Linux 3.0, azl3 golang 1.27.1-1 on Azure Linux 3.0, azl3 golang 1.27.3-1 on Azure Linux 3.0
1 Nov 2026 · 07:59:15 UTC Last revised31 Oct 2026 01:45 UTC → 1 Nov 2026 02:44 UTC
1 Nov 2026 · 07:59:15 UTC Affected productsazl3 golang 1.26.7-1 on Azure Linux 3.0 → azl3 golang 1.26.7-1 on Azure Linux 3.0, azl3 golang 1.27.1-1 on Azure Linux 3.0
31 Oct 2026 · 08:05:42 UTC Last revised23 Oct 2026 01:08 UTC → 31 Oct 2026 01:45 UTC
31 Oct 2026 · 08:05:42 UTC Published23 Oct 2026 01:08 UTC → 28 Oct 2026 01:47 UTC
31 Oct 2026 · 08:05:42 UTC Public detection templateNo Nuclei template listed
31 Oct 2026 · 08:05:42 UTC EPSSNot scored → No EPSS score collected
31 Oct 2026 · 08:05:42 UTC Affected productsazl3 gcc 13.2.0-7 on Azure Linux 3.0, azl3 golang 1.26.7-1 on Azure Linux 3.0, azl3 golang 1.27.1-1 on Azure Linux 3.0, azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0, azl3 tensorflow 2.16.1-11 on Azure Linux 3.0 → azl3 golang 1.26.7-1 on Azure Linux 3.0
31 Oct 2026 · 08:05:42 UTC Customer actionRequired: apply the update → Required: follow the MSRC remediation guidance
31 Oct 2026 · 08:05:42 UTC ComponentVisual Studio → Mariner
31 Oct 2026 · 08:05:42 UTC Publicly disclosedNo → Unknown: not stated by MSRC
31 Oct 2026 · 08:05:42 UTC Exploitation detectedNot reported by MSRC → Unknown: not stated by MSRC
31 Oct 2026 · 08:05:42 UTC CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N → CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U
31 Oct 2026 · 08:05:42 UTC SeverityImportant → Moderate
24 Oct 2026 · 07:49:07 UTC ComponentMariner → Visual Studio
24 Oct 2026 · 07:49:07 UTC SummaryDistrust compromised intermediate certificates in crypto/x509 → Go: CVE-2026-111943 Distrust compromised intermediate certificates in crypto/x509
24 Oct 2026 · 07:49:07 UTC TitleDistrust compromised intermediate certificates in crypto/x509 → Go: CVE-2026-111943 Distrust compromised intermediate certificates in crypto/x509
23 Oct 2026 · 09:33:49 UTC Public exploit codeUnknown: exploit-code evidence is incomplete or retained → No Nuclei template listed
23 Oct 2026 · 09:33:49 UTC CISA KEVUnknown: catalog evidence is incomplete or retained → Not listed in the collected catalog
23 Oct 2026 · 09:33:49 UTC Source coverage: public-exploit-codeIncomplete → Current
23 Oct 2026 · 09:33:49 UTC Source coverage: first-epssIncomplete → Current
23 Oct 2026 · 09:33:49 UTC Source coverage: cisa-kevIncomplete → Current
23 Oct 2026 · 09:33:49 UTC Source coverage: msrc-cvrfIncomplete → Current
23 Oct 2026 · 08:31:50 UTC Public exploit codeNo Nuclei template listed → Unknown: exploit-code evidence is incomplete or retained
23 Oct 2026 · 08:31:50 UTC CISA KEVNot listed in the collected catalog → Unknown: catalog evidence is incomplete or retained
23 Oct 2026 · 08:31:50 UTC Source coverage: public-exploit-codeCurrent → Incomplete
23 Oct 2026 · 08:31:50 UTC Source coverage: first-epssCurrent → Incomplete
23 Oct 2026 · 08:31:50 UTC Source coverage: cisa-kevCurrent → Incomplete
23 Oct 2026 · 08:31:50 UTC Source coverage: msrc-cvrfCurrent → Incomplete

Explore global source statements, affected packages and advisory history for CVE-2026-111943. The catalog has a separate collection scope from Microsoft release records.

Explicit identifiers and source references

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-111943 · Microsoft / collected KEV context

EUVD-2026-106926

GO-2026-6809

BIT-golang-2026-111943

RUSTSEC-2026-0381

RUSTSEC-2026-0382

RUSTSEC-2026-0383

cve-program · CVE-2026-111943

euvd · EUVD-2026-106926

nvd · CVE-2026-111943

osv · GO-2026-6809

osv · RUSTSEC-2026-0381

osv · RUSTSEC-2026-0382

osv · RUSTSEC-2026-0383

Related operational evidence

Explicit CVE identifiers

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denyl… · Advisory content revised · 7 Nov 2026
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denyl… · Advisory content revised · 5 Nov 2026
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denyl… · Advisory content revised · 3 Nov 2026
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denyl… · Advisory content revised · 1 Nov 2026
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denyl… · Advisory content revised · 31 Oct 2026
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denyl… · Advisory content revised · 30 Oct 2026
Distrust compromised intermediate certificates in crypto/x509 · Advisory content revised · 29 Oct 2026
Bundled root certificates allow trust in distrusted emSign intermediates · Advisory content revised · 29 Oct 2026
Certificate verification may accept distrusted intermediates · Advisory content revised · 29 Oct 2026
Bundled root certificates allow trust in distrusted emSign intermediates · Advisory content revised · 29 Oct 2026