WinMagic
Security Advisory
CVE-2026-106074 — Entropy Cache Persisted in Startup Snapshots and Single Executable Applications
Reference: KB-SEC-2026-1028-09 | Published: October 28, 2026 | Status: Not Affected
Applies to: SecureDoc Client, SES Console, SESWeb (all versions)
Third-party component affected: Node.js | Severity: Medium
Executive summary
WinMagic is aware of CVE-2026-106074 (Entropy Cache Persisted in Startup Snapshots and Single Executable Applications), a vulnerability affecting Node.js. WinMagic has reviewed this CVE against SecureDoc Client, the SES Console and SESWeb. None of these products is affected, for the reason given below. No remediation, patch, or configuration change is required in response to this CVE.
Vulnerability details
CVE ID | CVE-2026-106074 |
Title | Entropy Cache Persisted in Startup Snapshots and Single Executable Applications |
Affected third-party component | Node.js |
Severity | Medium |
CVSS | Not published by the Node.js project as a numeric score; the Node.js security release and downstream advisories rate it Medium severity. |
Affected versions (upstream) | Node.js 26.x, 24.x, and 22.x lines prior to the October 2026 security release, when startup snapshots or Single Executable Applications are used. |
What the vulnerability is
The entropy caches backing crypto.randomUUID() and randomInt() can be captured and saved into Node.js startup snapshots and Single Executable Applications (SEAs). Because the cache is baked into the snapshot or executable at build time, every process later launched from that same snapshot or SEA replays the same supposedly random values.
Why you should pay attention
Values produced by crypto.randomUUID() and randomInt() are often relied on for identifiers, tokens, or other values that are expected to be unpredictable and unique per process. If the same "random" values repeat across every process started from the same snapshot or packaged executable, anything depending on that unpredictability, such as session or resource identifiers, can become guessable or colliding across deployments.
WinMagic product assessment
SecureDoc Client, SES Console, and SESWeb
SecureDoc does not include, install or depend on a Node.js runtime.
Conclusion: SecureDoc Client, the SES Console and SESWeb are not affected by CVE-2026-106074.
Remediation
No WinMagic product-specific remediation, software update, patch, or configuration change is required in response to CVE-2026-106074. Organizations that run Node.js elsewhere in their own environment, outside of WinMagic products, should apply that vendor's own patch according to their standard process.
Ongoing monitoring
WinMagic continues to monitor relevant security advisories and available information concerning CVE-2026-106074. Should new information materially change this assessment, WinMagic will review its potential impact on SecureDoc Client, the SES Console or SESWeb and update this article accordingly.
Questions about this advisory
Customers with questions about this assessment can contact WinMagic Support through the usual support channel referencing KB-SEC-2026-1028-09.
WinMagic Corp.
winmagic.com