https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-26787.htmlhttps://patchthecve.com/cve/CVE-2025-26787.htmlWed, 17 Jun 2026 09:02:26 +0000MEDIUM 4.7: An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2. The Admin CLI command used to configure Certificate access to the initial startup of the container sets a property of "allowany" to allow any user with a valid and trusted client auth certifichttps://patchthecve.com/cve/CVE-2025-47222.htmlhttps://patchthecve.com/cve/CVE-2025-47222.htmlWed, 17 Jun 2026 09:27:37 +0000MEDIUM 6.5: A class name enumeration was found in Keyfactor SignServer versions prior to 7.3.2. Setting any chosen class name to any of the properties requiring a class path and the provided class is not expected to return different errors if the class exists in deployment or not. This returns information abouthttps://patchthecve.com/cve/CVE-2025-47221.htmlhttps://patchthecve.com/cve/CVE-2025-47221.htmlWed, 17 Jun 2026 09:27:36 +0000MEDIUM 5.3: An arbitrary file write was found in Keyfactor SignServer versions prior to 7.3.2. The properties ARCHIVETODISK_FILENAME-PATTERN, ARCHIVETODISK_PATH_BASE, ARCHIVETODISK_PATH_PATTERN can be set to any path, even ones that will point to files that already exist. This vulnerability gives a user with adhttps://patchthecve.com/cve/CVE-2025-47220.htmlhttps://patchthecve.com/cve/CVE-2025-47220.htmlWed, 17 Jun 2026 09:27:36 +0000MEDIUM 5.3: A local file enumeration was found in Keyfactor SignServer versions prior to 7.3.2 .The property VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH, which exists in the PDFSigner and the PAdESSigner, can be set to any path without any restrictions by an admin user. In the case that the provided path points to an ehttps://patchthecve.com/cve/CVE-2024-42006.htmlhttps://patchthecve.com/cve/CVE-2024-42006.htmlWed, 17 Jun 2026 07:48:37 +0000HIGH 7.5: Keyfactor AWS Orchestrator through 2.0 allows Information Disclosure.https://patchthecve.com/cve/CVE-2024-34458.htmlhttps://patchthecve.com/cve/CVE-2024-34458.htmlWed, 17 Jun 2026 07:33:27 +0000HIGH 7.5: Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in information disclosure.