# Bouncy Castle 1.78.1 (CVE-2025-14813, CVE-2025-8916, CVE-2026-0636, CVE-2026-5588): Update coming; Not Exploitable in Ignition

**URL:** <https://forum.inductiveautomation.com/t/bouncy-castle-1-78-1-cve-2025-14813-cve-2025-8916-cve-2026-0636-cve-2026-5588-update-coming-not-exploitable-in-ignition/117598>\
**Category:** Security Notices\
**Tags:** not-applicable, cve\
**Created:** [October 25, 2026, 2:35pm UTC](https://forum.inductiveautomation.com/t/bouncy-castle-1-78-1-cve-2025-14813-cve-2025-8916-cve-2026-0636-cve-2026-5588-update-coming-not-exploitable-in-ignition/117598 "2026-10-25T14:35:38Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![nathan.boeger](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nathan.boeger/32/87646_2.png) [@nathan.boeger](https://forum.inductiveautomation.com/u/nathan.boeger)\
**Post date:** [October 25, 2026, 2:35pm UTC](https://forum.inductiveautomation.com/t/bouncy-castle-1-78-1-cve-2025-14813-cve-2025-8916-cve-2026-0636-cve-2026-5588-update-coming-not-exploitable-in-ignition/117598/1 "2026-10-25T14:35:38Z")

</div>

**Ignition is assessed as not impacted by current Bouncy Castle cryptographic library CVEs**. Ignition 8.1.54 and 8.3.8 bundle Bouncy Castle 1.78.1, which falls in the affected range for these four CVEs (CVE-2025-14813, CVE-2025-8916, CVE-2026-0636, CVE-2026-5588), so dependency scanners will likely flag it. We’ve reviewed each against Ignition 8.1 and 8.3 and assessed that none are exploitable in Ignition.

CVE-2025-14813 (GOST 28147 CTR): Ignition never uses the GOST cipher. All cipher operations in the product use fixed AES, 3DES, or RSA algorithms. The affected class is present in the library but assessed as not reachable from Ignition code.

CVE-2025-8916, CVE-2026-0636, CVE-2026-5588: each requires a Bouncy Castle code path Ignition does not use. Certificate validation and signature verification in Ignition go through the JDK, not the affected components.

No current customer action is required. We’re updating Bouncy Castle to 1.85 or later on the normal release cycle (8.3.11 scheduled 11/17; 8.1.56 tbd) and will post to the Trust Center when the fixed builds ship. Inductive Automation recommends keeping Ignition software updated to protect from known and potential vulnerabilities.