IBM Common Cryptographic Architecture vulnerabilities

7 CVEs affecting IBM Common Cryptographic Architecture, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-13375, published 2026-02-04.

More from IBM.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-47150, published 2024-03-26. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Common Cryptographic Architecture (CCA) 7.0.0 through 7.5.36 could allow a remote user to cause a denial of service due to incorrect data handling for certain types of AES operations. IBM…
• CVE-2025-13375, published 2026-02-04. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Common Cryptographic Architecture (CCA) 7.5.52 and 8.4.82 could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system.
• CVE-2023-33855, published 2024-03-26. Low severity, CVSS 3.7. EPSS: 0.5% chance of exploitation in the next 30 days. Under certain conditions, RSA operations performed by IBM Common Cryptographic Architecture (CCA) 7.0.0 through 7.5.36 may exhibit non-constant-time behavior. This could allow a remote attacker to…
• CVE-2024-22340, published 2025-03-11. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow a remote attacker to obtain sensitive information during the creation of ECDSA signatures to perform a timing-based attack.
• CVE-2024-49823, published 2025-03-11. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow an authenticated user to cause a denial of service in the Hardware Security Module (HSM) using a specially crafted sequence of…
• CVE-2022-22423, published 2022-09-23. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Common Cryptographic Architecture (CCA 5.x MTM for 4767 and CCA 7.x MTM for 4769) could allow a local user to cause a denial of service due to improper input validation. IBM X-Force ID: 223596.
• CVE-2024-41760, published 2025-03-11. Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow an attacker to obtain sensitive information due to a timing attack during certain RSA operations.