Knowledgebase

Symptoms

In September 2026, an OpenSSL vulnerability was identified: https://nvd.nist.gov/vuln/detail/cve-2026-84782

As noted on the official Nist.gov site above, this only affects OpenSSL when used in specific scenarios - None of which apply to our use in the Editor or our SDK products. Most notably, the only outdated version of OpenSSL is used in a third-party component (MIP SDK). The Editor itself uses fully up-to-date versions (at the time of writing this article OpenSSL - v3.5.9)

Cause

The reason the affected version still exists in our software (at the time of writing) - is that it is part of Microsoft's own MIP SDK, which is utilized in our Azure plugin. Its continued existence in the current release, would imply that Microsoft is aware of the issue, and has confirmed this does not affect the methods which their SDK can utilize such communication. In turn, nothing that we can do with it would be affected either.

Resolution

While no action is necessary, this section is for those who are exceptionally security minded. You can disable the affected OpenSSL module entirely, simply by disabling our AzureRMS plugin.  This can be done via the Preferences menu (Ctrl_K) under the Plugins menu, or during a custom installation of the software, see here.