CVE-2023-49570 is a high severity flaw, scored 7.4, in the HTTPS scanning feature of Bitdefender Total Security: it trusts a certificate issued by an entity that is not authorized to issue certificates. Bitdefender fixed it in version 27.0.25.115, delivered by automatic update.
What's affected
The record says the HTTPS scanning feature of Bitdefender Total Security trusts a certificate when its Basic Constraints extension marks it as an End Entity, so an attacker could mount a man in the middle attack. Bitdefender's advisory says the fixed version is 27.0.25.115 and that it arrives through an automatic update. It does not state an affected version range.
The severities differ by scoring system. NVD gives a CVSS 3.1 score of 7.4 High with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, while Bitdefender's advisory gives a CVSS 4.0 score of 8.6. Both are high, and the higher number comes from the newer scoring method.
How to check if you're exposed
Open Bitdefender Total Security and look at the product version in the About or Settings area. Compare it with 27.0.25.115. Anything lower should update.
Trigger an update from inside the product if it has not run yet. Because the fix is delivered automatically, most machines with updates enabled should already have it, so the check is mainly for machines that are offline, paused or managed in a way that blocks updates.
What to do now
- Check the Total Security version on each machine against 27.0.25.115.
- Run the product's update if the machine is below that version.
- Check that automatic updates are enabled and not blocked by a proxy or policy.
- For machines that stay offline for long periods, schedule a manual update.
- Remember that the advisory lists no other workaround.
Why it matters
The weakness is improper certificate validation, CWE-295. HTTPS scanning means the security product opens encrypted traffic by acting as a middleman, so its certificate checks stand in for the browser's. A mistake in those checks weakens trust for every site that the product inspects.
The attack complexity is high in the vector, because the attacker must be placed on the network path. That keeps the score at 7.4 even with high confidentiality and integrity impact. KEV status is false for this CVE.
Products that sit in the middle of encrypted traffic carry extra responsibility. When one of them gets validation wrong, the protection the user expected from HTTPS is quietly gone.
Administrators who manage endpoint security centrally should check that update channels work on every machine, including laptops that travel. A fix that is delivered automatically only helps machines that actually receive it, and the version check above is how you find the ones that did not.
Quick check
Why do the two scores differ?
NVD uses CVSS 3.1 and gives 7.4. Bitdefender's advisory uses CVSS 4.0 and gives 8.6. Both place it in the high band.
Sources
Bitdefender security advisory VA-11210
Last reviewed: 19 October 2026.
