Cyber ·
USN-9088-1: TigerVNC can accept fake servers after a certificate exception
An Ubuntu Security notice describes a flaw in the TigerVNC viewer, which stores TLS certificate exceptions as trusted authorities and allows impersonation of VNC servers.
Source: notice USN-9088-1, published on 12 November 2026 in the Ubuntu Security feed, with automatic translation of the content. The problem: the TigerVNC viewer stored TLS certificate exceptions as trusted certificate authorities. Described impact: a remote attacker could possibly exploit this to impersonate any VNC server after a user added a certificate exception for the attacker's server. The text received does not state affected versions or the fixed version. To confirm, consult the original notice on the official Ubuntu Security site and the package page for your distribution. Practical check: confirm the vulnerable versions in the notice, compare them with the installed version, and apply the update offered by your distribution. Relevance to Rota Nacional: the platform does not manage third-party VNC viewers or patch workstations. Even so, if your team reaches environments through remote access, treat certificate exceptions as security decisions and do not accept them out of habit. If you use AI to study the notice, do not paste credentials, internal addresses or personal data into the model; remove them first.