Loading story…
Red Hat disclosed CVE-2026-11861, a FreeIPA privilege-escalation flaw affecting deployments that maintain a trust relationship with Active Directory. In vulnerable environments, an authenticated AD user can impersonate a client name in a Kerberos Ticket Granting Service (TGS) request and bypass authentication to FreeIPA services because affected components trust the TGS cname field and do not properly verify Privilege Attribute Certificate (PAC) certificates. Red Hat said the issue can affect the FreeIPA portal, SMB server, LDAP directory, and likely other GSSAPI-enabled services, creating a path to privilege escalation inside the FreeIPA domain.
The vendor assigned the bug a CVSS 9.6 score but rated it Moderate because exploitation depends on uncommon prerequisites, including a configured FreeIPA-AD cross-realm trust, valid AD credentials, and an AD setup that allows a duplicate or conflicting SPN condition. Red Hat listed ipa packages in RHEL 7, 8, 9, and 10 as affected, while noting that patched and modern Microsoft environments—including Windows Server 2012 R2 with MSKB-3070083 and newer defaults such as Windows 11 22H2—can block the attack path on the AD side. No mitigation meeting Red Hat Product Security criteria was available at publication time, and defenders were urged to review trust relationships, enforce SPN and UPN uniqueness, and monitor for vendor fixes.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat's CVE entry states that CVE-2026-11861 was made public on August 20, 2026. The disclosure described a FreeIPA privilege-escalation flaw affecting environments with FreeIPA-Active Directory trust relationships.
Red Hat Bugzilla 2487472 documented a vulnerability in FreeIPA deployments that trust Active Directory, where an AD user could impersonate a cname in a Kerberos TGS request to bypass authentication to FreeIPA services and potentially escalate privileges.
The CVE identifier CVE-2026-11861 was reserved for the FreeIPA and Active Directory trust authentication bypass issue. The referenced reporting ties the reservation to June 10, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
threataft.com
Open sourceaccess.redhat.com
Open sourcetenable.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat disclosed **CVE-2026-76578** (CVSS 9.8), a critical FreeIPA privilege-escalation flaw that lets an unauthenticated remote LDAP client create an attacker-controlled Kerberos principal and add it to the FreeIPA administrators group. The attack combines FreeIPA’s overly permissive self-service OTP token access-control rule with **CVE-2026-76560** in 389 Directory Server, where anonymous clients can satisfy an ownership check when an owner field is empty. Researchers reproduced the attack against a default FreeIPA deployment, producing reusable administrator Kerberos credentials; SID-enabled environments may also permit PAC-bearing tickets that expand access to HTTP and Dogtag services. RHEL 7, 8, 9, and 10 IPA/IdM components are affected. FreeIPA 4.13.4 addresses the FreeIPA-side issues, while Red Hat released RHEL 9 389 Directory Server updates through **RHSA-2026:64781**, including fixes for the anonymous LDAP authorization-control bypass, a SASL PLAIN privilege-escalation issue, a heap buffer overflow, and a pre-authentication NULL-pointer dereference. Organizations should urgently apply available updates; until all relevant packages are available, restrict LDAP ports 389 and 636 to trusted hosts and evaluate disabling anonymous LDAP binds. Red Hat reported no public evidence of active exploitation.
Sep 10, 2026
Red Hat released fixes for **CVE-2026-18922**, a critical (CVSS 9.8) authentication-bypass vulnerability in 389 Directory Server. An unauthenticated attacker able to connect over LDAPS can submit a failed SASL PLAIN bind using `cn=Directory Manager`, then perform a SASL ANONYMOUS bind on the same connection; Cyrus SASL can retain the prior identity, granting Directory Manager privileges with full confidentiality, integrity, and availability impact. The updates also remediate **CVE-2026-18355**, a SASL wrapped-record heap buffer overflow; **CVE-2026-18453**, a pre-authentication NULL-pointer denial of service; and **CVE-2026-76560**, which lets anonymous LDAP clients bypass certain SELFDN ACI bind-rule checks using an empty bind DN. Red Hat issued advisories for affected 389 Directory Server and Red Hat Directory Server packages across supported RHEL 6, 8, 9, and 10 streams; administrators should promptly apply the relevant `389-ds-base` or `redhat-ds` updates. No known public exploits were reported in the referenced advisories.
Sep 14, 2026
Red Hat released **Important** security updates for `sssd` to address two vulnerabilities tracked as **CVE-2026-14474** and **CVE-2026-14476** across multiple Red Hat Enterprise Linux versions and support channels, including RHEL 7 ELS, RHEL 8.4/8.6/8.8, RHEL 9.2/9.4/9.6, and RHEL 10, as well as related SAP, AUS, EUS, ELS, and CodeReady Linux Builder offerings. The first flaw affects deployments using `sudo_provider=ldap` or `sudo_provider=ad`: when `ldap_sudo_search_base` is left unset, SSSD searches from the LDAP domain root for `sudoRole` objects, allowing an LDAP principal with write access in any subtree to create a malicious rule that grants arbitrary sudo privileges on every enrolled host. Red Hat said `sudo_provider=ipa` is not affected. The second flaw, **CVE-2026-14476**, stems from unsanitized `gPCFileSysPath` handling in SSSD's Active Directory GPO provider, enabling path traversal through `..` components after backslashes are converted to forward slashes. Red Hat warned that an attacker with AD GPO management access could write files outside the GPO cache as root; on SELinux-enforcing systems this can be used to target `/var/lib/sss/pubconf/krb5.include.d/` and redirect Kerberos KDC configuration for authentication bypass, while systems with SELinux permissive or disabled may face arbitrary root file write. Fixes were shipped through RHSA advisories including **RHSA-2026:41937**, **RHSA-2026:42122**, **RHSA-2026:46482**, and a series of August updates covering older and specialized RHEL channels.
Aug 25, 2026