CVE-2021-22926

Think of this like a hotel that calls for a guest by name instead of checking their room key — if someone sneaks in and claims that name first, the hotel staff hands over the wrong person's belongings. Here, software asking for a security certificate 'by name' on certain Mac systems can be fooled into using a fake certificate planted by a sneaky user with access to the same shared folder, which could let that attacker impersonate a trusted connection.

This matters to you if you run software built on curl/libcurl using Apple's Secure Transport TLS library on macOS, or if you use NetApp (Active IQ Unified Manager, Data ONTAP, HCI, OnCommand, SnapCenter, SolidFire), Oracle MySQL, Siemens SINEC, or SolarWinds products listed as affected — check with each vendor for your specific version. It's only a real risk if the affected application runs from a directory that untrusted local users can also write to, such as a shared /tmp folder.

A public proof-of-concept exploit exists, and the conditions needed to trigger this (specific macOS TLS backend, by-name certificate lookup, writable shared directory) are fairly narrow, so this isn't being mass-exploited today. Treat it as a real but moderate-priority item — confirm exposure and patch affected systems in your normal update cycle rather than treating it as an emergency.

1. Audit all applications and infrastructure that link against libcurl, specifically identifying any built on macOS with the Secure Transport (SecureTransport) TLS backend rather than OpenSSL/LibreSSL. 2. Check whether CURLOPT_SSLCERT / --cert is used with a certificate name rather than an explicit file path, and whether the process's current working directory is a shared, world-writable location (e.g. /tmp). 3. Upgrade curl/libcurl to 7.78.0 or later, which removes the name-based lookup fallback to file-based resolution. 4. For affected vendor products, apply vendor-specific patches: NetApp products per their individual advisories, Oracle per the January 2022 and October 2021 Critical Patch Updates (cpujan2022/cpuoct2021), Siemens SINEC Infrastructure Network Services to V3.1.5 or later, and SolarWinds Universal Forwarder to 8.2.12. 5. As a temporary mitigation if patching is delayed, ensure affected applications always specify certificates by full, explicit file path rather than by name, and avoid running them from directories writable by untrusted local users. 6. Monitor for unexpected TLS handshake failures or certificate mismatches as a sign of attempted exploitation; no CISA KEV due date applies since this is not in the Known Exploited Vulnerabilities catalog.

CVSS 7.5 (High) — network attack vector, low complexity, no privileges or user interaction required for the TLS handshake itself, though exploitation depends on local filesystem write access and preconditions (macOS Secure Transport backend, by-name cert lookup, writable CWD). Weakness types: CWE-295 (Improper Certificate Validation) and CWE-840 (Business Logic Errors). Not listed in CISA KEV; no confirmed in-the-wild exploitation. One public exploit/PoC is known, and EPSS places predicted exploitation likelihood in the 97th percentile with a rising trend, indicating elevated attacker interest despite no confirmed campaigns. Press attention is rising but should not be conflated with active exploitation. Fixed upstream in curl 7.78.0; multiple downstream vendors (NetApp, Oracle, Siemens, SolarWinds) have issued their own patched releases/advisories.