A security researcher has disclosed nine vulnerabilities in disk encryption and pre-boot authentication software used in ATMs and across multiple other industries, raising concerns about how software flaws propagate through complex supply chains before reaching end users.
Matt Burch, who has spent five years researching ATM security, presented his findings at the Black Hat and Defcon security conferences in Las Vegas in August 2026. The vulnerabilities were found in CryptoPro Secure Disk, software made by German firm CryptWare. The flaws could have been exploited to bypass CryptoPro’s integrity checks and gain full access to encrypted devices.
CryptoPro is used by ATM manufacturers, including as part of Diebold Nixdorf’s Vynamic Security Suite, but is also sold to embedded-device makers and large organizations running Microsoft Windows. CryptWare managing director Uwe Saame told WIRED the company patched all nine bugs in two phases — version 7.7.2 in early November and version 7.7.3 in early December. Saame said CryptoPro has hundreds of customers across automotive, banking, government, manufacturing, research, finance, and healthcare sectors, as well as extensive ATM installations.
Diebold Nixdorf said only two of the nine vulnerabilities were relevant to its systems and issued fixes for those in December, adding that neither could have been exploited on their own to compromise one of its ATMs.
Burch said CryptWare was prompt and collaborative during the disclosure process, and he confirmed the patches resolved the vulnerabilities he identified.
The case highlights a recurring challenge in software security: after a developer releases a patch, companies that embed that software in their own products must develop tailored fixes, and then customers must be notified and apply the updates — a process that can be slow for systems deployed in the field.
“ATMs are what brought me down this path, but I think there may be an even higher impact of these findings beyond that,” Burch said.
Source: WIRED