CVE-2026-2673

CVE-2026-2673 is a high-severity (CVSS 7.5) vulnerability affecting OpenSSL TLS 1.3 servers in versions 3.5 and 3.6. This flaw occurs when the server's key exchange group configuration uses the 'DEFAULT' keyword, leading to the negotiation of a less preferred key exchange group, such as a classical one instead of a more robust post-quantum group, even when the latter is mutually supported. This network-exploitable issue carries a high confidentiality impact due to the use of a weaker cryptographic agreement than intended, though it does not affect integrity or availability. There is currently no evidence of active exploitation, no public exploit code available, and it is not listed on CISA's KEV catalog. Affected organizations should plan to upgrade to OpenSSL 3.5.6 or 3.6.2 once these patched versions are released.