CVE-2026-1814 — Rapid7 Nexpose Insecure Java Keystore Password Generation
Rapid7 Nexpose versions 6.4.50 and later are vulnerable to an insufficient entropy issue in the CredentialsKeyStorePassword.generateRandomPassword() method. When updating legacy…
Published: 2026-02-03 · CVSS: 6.8 · CVSS 4.0
Rapid7 Nexpose versions 6.4.50 and later are vulnerable to an insufficient entropy issue in the CredentialsKeyStorePassword.generateRandomPassword() method. When updating legacy keystore passwords, the application generates a new password with insufficient length (7-12 characters) and a static prefix 'p', resulting in a weak keyspace. An attacker with access to the nsc.ks file can brute-force this password using consumer-grade hardware to decrypt stored credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7