Loading story…
Red Hat disclosed CVE-2026-76578 (CVSS 9.8), a critical FreeIPA privilege-escalation flaw that lets an unauthenticated remote LDAP client create an attacker-controlled Kerberos principal and add it to the FreeIPA administrators group. The attack combines FreeIPA’s overly permissive self-service OTP token access-control rule with CVE-2026-76560 in 389 Directory Server, where anonymous clients can satisfy an ownership check when an owner field is empty. Researchers reproduced the attack against a default FreeIPA deployment, producing reusable administrator Kerberos credentials; SID-enabled environments may also permit PAC-bearing tickets that expand access to HTTP and Dogtag services.
RHEL 7, 8, 9, and 10 IPA/IdM components are affected. FreeIPA 4.13.4 addresses the FreeIPA-side issues, while Red Hat released RHEL 9 389 Directory Server updates through RHSA-2026:64781, including fixes for the anonymous LDAP authorization-control bypass, a SASL PLAIN privilege-escalation issue, a heap buffer overflow, and a pre-authentication NULL-pointer dereference. Organizations should urgently apply available updates; until all relevant packages are available, restrict LDAP ports 389 and 636 to trusted hosts and evaluate disabling anonymous LDAP binds. Red Hat reported no public evidence of active exploitation.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
Amazon Linux published ALAS-2026-3916 for Amazon Linux 2, updating affected Identity Management (IPA) packages to address critical CVE-2026-76578. The advisory covers IPA client, server, DNS, trust, and related Python packages.
Red Hat published RHSA-2026:64785 for RHEL 10, providing 389-ds-base-3.2.0-10.el10_2 as part of product-specific fixes for the directory-server issues, including CVE-2026-76560.
Red Hat published RHSA-2026:64778 for RHEL 9, updating 389-ds-base, 389-ds-base-libs, and python3-lib389 to remediate four 389 Directory Server flaws. The update includes critical CVE-2026-18922, a SASL PLAIN stale-identity issue that can elevate privileges to Directory Manager, along with overflow, denial-of-service, and LDAP access-control-bypass flaws.
Red Hat published RHSA-2026:64781 for RHEL 9, addressing four 389 Directory Server vulnerabilities and related lib389 replication issues. The advisory provides updates for affected 389-ds-base, 389-ds-base-libs, and python3-lib389 packages.
Four vulnerabilities affecting 389 Directory Server, including CVE-2026-18355, CVE-2026-18453, CVE-2026-18922, and CVE-2026-76560, were published. CVE-2026-76560 concerns an anonymous LDAP client's ability to bypass SELFDN ACI bind-rule checks using an empty bind DN.
FreeIPA version 4.13.4 fixes the CVE-2026-76578 chain-related issue and CVE-2026-79678. The latter is an authenticated idp-add input-validation flaw that can expose process environment variables through errors and cause memory exhaustion, though Red Hat stated it cannot be used for code execution.
Red Hat disclosed CVE-2026-76578, a critical FreeIPA flaw that can be chained with 389 Directory Server CVE-2026-76560 to allow an unauthenticated LDAP client to create an attacker-controlled Kerberos principal and obtain FreeIPA administrator-group access. Red Hat reproduced the chain on default FreeIPA deployments and recommended restricting LDAP access and considering disabling anonymous binds until fixes are installed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
11 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcetenable.com
Open sourcethehackernews.com
Open sourcetenable.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat disclosed **CVE-2026-11861**, a FreeIPA privilege-escalation flaw affecting deployments that maintain a trust relationship with **Active Directory**. In vulnerable environments, an authenticated AD user can impersonate a client name in a Kerberos **Ticket Granting Service (TGS)** request and bypass authentication to FreeIPA services because affected components trust the TGS `cname` field and do not properly verify **Privilege Attribute Certificate (PAC)** certificates. Red Hat said the issue can affect the FreeIPA portal, SMB server, LDAP directory, and likely other GSSAPI-enabled services, creating a path to privilege escalation inside the FreeIPA domain. The vendor assigned the bug a **CVSS 9.6** score but rated it **Moderate** because exploitation depends on uncommon prerequisites, including a configured FreeIPA-AD cross-realm trust, valid AD credentials, and an AD setup that allows a duplicate or conflicting **SPN** condition. Red Hat listed `ipa` packages in **RHEL 7, 8, 9, and 10** as affected, while noting that patched and modern Microsoft environments—including **Windows Server 2012 R2** with **MSKB-3070083** and newer defaults such as **Windows 11 22H2**—can block the attack path on the AD side. No mitigation meeting Red Hat Product Security criteria was available at publication time, and defenders were urged to review trust relationships, enforce SPN and UPN uniqueness, and monitor for vendor fixes.
Aug 22, 2026
Red Hat released fixes for **CVE-2026-18922**, a critical (CVSS 9.8) authentication-bypass vulnerability in 389 Directory Server. An unauthenticated attacker able to connect over LDAPS can submit a failed SASL PLAIN bind using `cn=Directory Manager`, then perform a SASL ANONYMOUS bind on the same connection; Cyrus SASL can retain the prior identity, granting Directory Manager privileges with full confidentiality, integrity, and availability impact. The updates also remediate **CVE-2026-18355**, a SASL wrapped-record heap buffer overflow; **CVE-2026-18453**, a pre-authentication NULL-pointer denial of service; and **CVE-2026-76560**, which lets anonymous LDAP clients bypass certain SELFDN ACI bind-rule checks using an empty bind DN. Red Hat issued advisories for affected 389 Directory Server and Red Hat Directory Server packages across supported RHEL 6, 8, 9, and 10 streams; administrators should promptly apply the relevant `389-ds-base` or `redhat-ds` updates. No known public exploits were reported in the referenced advisories.
Sep 14, 2026
Red Hat released **Important** security updates for `sssd` to address two vulnerabilities tracked as **CVE-2026-14474** and **CVE-2026-14476** across multiple Red Hat Enterprise Linux versions and support channels, including RHEL 7 ELS, RHEL 8.4/8.6/8.8, RHEL 9.2/9.4/9.6, and RHEL 10, as well as related SAP, AUS, EUS, ELS, and CodeReady Linux Builder offerings. The first flaw affects deployments using `sudo_provider=ldap` or `sudo_provider=ad`: when `ldap_sudo_search_base` is left unset, SSSD searches from the LDAP domain root for `sudoRole` objects, allowing an LDAP principal with write access in any subtree to create a malicious rule that grants arbitrary sudo privileges on every enrolled host. Red Hat said `sudo_provider=ipa` is not affected. The second flaw, **CVE-2026-14476**, stems from unsanitized `gPCFileSysPath` handling in SSSD's Active Directory GPO provider, enabling path traversal through `..` components after backslashes are converted to forward slashes. Red Hat warned that an attacker with AD GPO management access could write files outside the GPO cache as root; on SELinux-enforcing systems this can be used to target `/var/lib/sss/pubconf/krb5.include.d/` and redirect Kerberos KDC configuration for authentication bypass, while systems with SELinux permissive or disabled may face arbitrary root file write. Fixes were shipped through RHSA advisories including **RHSA-2026:41937**, **RHSA-2026:42122**, **RHSA-2026:46482**, and a series of August updates covering older and specialized RHEL channels.
Aug 25, 2026