CVE-2023-6055 is a high severity (CVSS 7.4 in the record) certificate validation flaw in the HTTPS scanning feature of Bitdefender Total Security. Certificates that lack Server Authentication in the Extended Key Usage field were accepted as valid, which could allow a man-in-the-middle attack. Bitdefender says an automatic update to 27.0.25.115 fixes it.
What's affected
- Product: Bitdefender Total Security, HTTPS scanning feature.
- Affected: versions before 27.0.25.115. The advisory names the product but gives no lower bound.
- Fixed: 27.0.25.115, delivered by automatic update, per advisory VA-11158.
- Severity: the NVD record says 7.4 High. Bitdefender scores it 8.6 using CVSS 4.0 (vector CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N). The scoring systems differ, and both agree it is serious.
- Position needed: an attacker on the network path, adjacent to the victim, per the CVSS 4.0 vector.
How to check if you're exposed
Open Bitdefender, go to the About or Settings area, and read the product version. Anything below 27.0.25.115 needs the update. Bitdefender says the update is automatic, so most installations should already have it, but machines that were offline or had updates paused may not.
Across a fleet, use your endpoint inventory to list the installed version of Bitdefender Total Security. Consumer products are often unmanaged, so ask users of personal or contractor laptops to check too.
What to do now
- Run the product update and confirm the version is 27.0.25.115 or later.
- Keep automatic updates on, and do not pause security product updates for long periods.
- Avoid untrusted networks such as public Wi-Fi until the update is confirmed.
- Where policy allows, consider whether HTTPS scanning is needed at all, and use only what you can keep updated.
- Add the product to your inventory so future advisories are matched quickly.
Why it matters
HTTPS scanning works by placing the security product between your browser and the website. It terminates the encrypted connection, inspects it, and opens its own connection to the site. That makes the product responsible for checking the site's certificate correctly, because your browser no longer sees it. The record lists CWE-295, improper certificate validation.
In this case the check skipped the Extended Key Usage requirement. A certificate that was not meant for server authentication could still be accepted, so an attacker on the network path could present one and read or alter traffic. Security software sits in a trusted spot, so flaws in it carry extra weight. The record does not list this CVE as known exploited. This is one of three related Bitdefender certificate advisories published together in October 2024.
Quick check
Why are there two scores?
The NVD record uses CVSS 3.1 and gives 7.4. Bitdefender uses CVSS 4.0 and gives 8.6. Different scoring systems weigh the same facts differently.
Sources
Last reviewed: 19 October 2026.
