Imprivata EAM key cannot be rotated
Imprivata Enterprise Access Management has no way to rotate its RSA key, letting a stolen private key impersonate the appliance indefinitely.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT/CC published VU#273940 describing a design flaw in Imprivata Enterprise Access Management (EAM), an SSO/authentication platform widely used in clinical environments, affecting versions 26.2.6 and below. The appliance generates its X.509 identity certificate from a single RSA key pair with no supported mechanism to rotate it after deployment. Because Imprivata EAM brokers authentication for clinical workstations, EHR platforms, and shared-device workflows, an attacker who obtains the private key — via backup exfiltration, hypervisor snapshot theft, or privileged filesystem access — can impersonate the trusted appliance indefinitely, intercepting SSO tokens, session assertions, and credentials across every downstream system that trusts it. If forward secrecy is not enforced on upstream connections, previously captured traffic could also be decrypted retroactively.
There is no CVE exploitation reported in the wild; this is a disclosed design weakness (CVE-2026-82356) rather than an active campaign. Imprivata did not respond to CERT/CC's coordination attempts but is reportedly aware and tracking the issue internally, with no fix or timeline published. Because the underlying key cannot be replaced short of a full appliance redeployment, any compromise of the key has an unusually long tail of exposure compared to typical certificate-based flaws.
Defenders running Imprivata EAM should treat the appliance's private key and any backups/snapshots containing it as high-value assets: restrict filesystem and administrative access tightly, secure and encrypt backups and hypervisor snapshots, and enforce perfect forward secrecy on all upstream TLS connections to limit retroactive decryption risk if the key is ever exposed. Monitor for unexpected certificate reuse or duplicate appliance identities on the network as a possible indicator of impersonation, and prepare a redeployment plan since that is currently the only remediation path.
Mentioned in this report
Source reporting: https://kb.cert.org/vuls/id/273940
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs