389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn
Priority MEDIUM 40CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 25 fixed, 4 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-863.
Summary
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated identity. This can allow an anonymous LDAP client to perform an operation, such as adding or modifying a directory entry, that a SELFDN-based ACI intended to restrict to a specific authenticated user.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00556 46th percentileScored 2026-11-07
Fix Partial Red Hat: 17 advisoriesRed Hat: 25 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Directory Server 11.5 E4S for RHEL 8 | — | 8060020260908152739.0ca98e7e | Patch available | CNA |
| Red Hat | Red Hat Directory Server 11.7 E4S for RHEL 8 | — | 8080020260903102346.f969626e | Patch available | CNA |
| Red Hat | Red Hat Directory Server 11.9 for RHEL 8 | — | 8100020260904171440.37ed7c03 | Patch available | CNA |
| Red Hat | Red Hat Directory Server 12.2 E4S for RHEL 9 | — | 9020020260903155914.1674d574 | Patch available | CNA |
| Red Hat | Red Hat Directory Server 12.4 E4S for RHEL 9 | — | 9040020260903102623.1674d574 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | 3.2.0-10.el10_2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | 3.0.6-21.el10_0 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | 1.3.11.1-15.el7_9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 8100020260904155442.25e700aa | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | 8040020260901171549.96015a92 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | 8040020260901171549.96015a92 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | 8060020260901145727.824efc52 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | 8060020260901145727.824efc52 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | 8080020260831180218.6dbb3803 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | 8080020260831180218.6dbb3803 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 2.8.0-10.el9_8 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | 2.2.4-22.el9_2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | 2.4.5-29.el9_4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | 2.6.1-24.el9_6 | Patch available | CNA |
| Red Hat | Red Hat Directory Server 13.2 | — | 1788851765 | Patch available | CNA |
| Red Hat | Red Hat Directory Server 11 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Directory Server 12 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Directory Server 12 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Directory Server 13 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | No fix listed | CNA |
- Red Hat Directory Server 11.5 E4S for RHEL 8 VendorRed Hat Affected — Fixed in 8060020260908152739.0ca98e7e Patch available CNA
- Red Hat Directory Server 11.7 E4S for RHEL 8 VendorRed Hat Affected — Fixed in 8080020260903102346.f969626e Patch available CNA
- Red Hat Directory Server 11.9 for RHEL 8 VendorRed Hat Affected — Fixed in 8100020260904171440.37ed7c03 Patch available CNA
- Red Hat Directory Server 12.2 E4S for RHEL 9 VendorRed Hat Affected — Fixed in 9020020260903155914.1674d574 Patch available CNA
- Red Hat Directory Server 12.4 E4S for RHEL 9 VendorRed Hat Affected — Fixed in 9040020260903102623.1674d574 Patch available CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 3.2.0-10.el10_2 Patch available CNA
- Red Hat Enterprise Linux 10.0 Extended Update Support VendorRed Hat Affected — Fixed in 3.0.6-21.el10_0 Patch available CNA
- Red Hat Enterprise Linux 7 Extended Lifecycle Support VendorRed Hat Affected — Fixed in 1.3.11.1-15.el7_9 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8100020260904155442.25e700aa Patch available CNA
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 8040020260901171549.96015a92 Patch available CNA
- Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 8040020260901171549.96015a92 Patch available CNA
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 8060020260901145727.824efc52 Patch available CNA
- Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 8060020260901145727.824efc52 Patch available CNA
- Red Hat Enterprise Linux 8.8 Telecommunications Update Service VendorRed Hat Affected — Fixed in 8080020260831180218.6dbb3803 Patch available CNA
- Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 8080020260831180218.6dbb3803 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2.8.0-10.el9_8 Patch available CNA
- Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.2.4-22.el9_2 Patch available CNA
- Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.4.5-29.el9_4 Patch available CNA
- Red Hat Enterprise Linux 9.6 Extended Update Support VendorRed Hat Affected — Fixed in 2.6.1-24.el9_6 Patch available CNA
- Red Hat Directory Server 13.2 VendorRed Hat Affected — Fixed in 1788851765 Patch available CNA
- Red Hat Directory Server 11 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Directory Server 12 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Directory Server 12 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Directory Server 13 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE names CNA · 27
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:directory_server_e4s:11.5::el8 | 11.5 | — | Red Hat |
| cpe:/a:redhat:directory_server_e4s:11.7::el8 | 11.7 | — | Red Hat |
| cpe:/a:redhat:directory_server:11.9::el8 | 11.9 | — | Red Hat |
| cpe:/a:redhat:directory_server_e4s:12.2::el9 | 12.2 | — | Red Hat |
| cpe:/a:redhat:directory_server_e4s:12.4::el9 | 12.4 | — | Red Hat |
| cpe:/o:redhat:enterprise_linux:10.2 | 10.2 | — | Red Hat |
| cpe:/o:redhat:enterprise_linux_eus:10.0 | 10.0 | — | Red Hat |
| cpe:/o:redhat:rhel_els:7 | 7 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:8::appstream | 8 | — | Red Hat |
| cpe:/a:redhat:rhel_aus:8.4::appstream | 8.4 | — | Red Hat |
- cpe:/a:redhat:directory_server_e4s:11.5::el8 Versions 11.5 — ·Red Hat
- cpe:/a:redhat:directory_server_e4s:11.7::el8 Versions 11.7 — ·Red Hat
- cpe:/a:redhat:directory_server:11.9::el8 Versions 11.9 — ·Red Hat
- cpe:/a:redhat:directory_server_e4s:12.2::el9 Versions 12.2 — ·Red Hat
- cpe:/a:redhat:directory_server_e4s:12.4::el9 Versions 12.4 — ·Red Hat
- cpe:/o:redhat:enterprise_linux:10.2 Versions 10.2 — ·Red Hat
- cpe:/o:redhat:enterprise_linux_eus:10.0 Versions 10.0 — ·Red Hat
- cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:8::appstream Versions 8 — ·Red Hat
- cpe:/a:redhat:rhel_aus:8.4::appstream Versions 8.4 — ·Red Hat
Show 17 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:rhel_eus_long_life:8.4::appstream | 8.4 | — | Red Hat |
| cpe:/a:redhat:rhel_aus:8.6::appstream | 8.6 | — | Red Hat |
| cpe:/a:redhat:rhel_eus_long_life:8.6::appstream | 8.6 | — | Red Hat |
| cpe:/a:redhat:rhel_e4s:8.8::appstream | 8.8 | — | Red Hat |
| cpe:/a:redhat:rhel_tus:8.8::appstream | 8.8 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:9::appstream | 9 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:9::crb | 9 | — | Red Hat |
| cpe:/a:redhat:rhel_e4s:9.2::appstream | 9.2 | — | Red Hat |
| cpe:/a:redhat:rhel_e4s:9.4::appstream | 9.4 | — | Red Hat |
| cpe:/a:redhat:rhel_eus:9.6::appstream | 9.6 | — | Red Hat |
| cpe:/a:redhat:rhel_eus:9.6::crb | 9.6 | — | Red Hat |
| cpe:/a:redhat:directory_server:13.2::el10 | 13.2 | — | Red Hat |
| cpe:/a:redhat:directory_server:11 | 11 | — | Red Hat |
| cpe:/a:redhat:directory_server:12 | 12 | — | Red Hat |
| cpe:/a:redhat:directory_server:13 | 13 | — | Red Hat |
| cpe:/o:redhat:rhel_els:6 | 6 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:8 | 8 | — | Red Hat |
- cpe:/a:redhat:rhel_eus_long_life:8.4::appstream Versions 8.4 — ·Red Hat
- cpe:/a:redhat:rhel_aus:8.6::appstream Versions 8.6 — ·Red Hat
- cpe:/a:redhat:rhel_eus_long_life:8.6::appstream Versions 8.6 — ·Red Hat
- cpe:/a:redhat:rhel_e4s:8.8::appstream Versions 8.8 — ·Red Hat
- cpe:/a:redhat:rhel_tus:8.8::appstream Versions 8.8 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:9::crb Versions 9 — ·Red Hat
- cpe:/a:redhat:rhel_e4s:9.2::appstream Versions 9.2 — ·Red Hat
- cpe:/a:redhat:rhel_e4s:9.4::appstream Versions 9.4 — ·Red Hat
- cpe:/a:redhat:rhel_eus:9.6::appstream Versions 9.6 — ·Red Hat
- cpe:/a:redhat:rhel_eus:9.6::crb Versions 9.6 — ·Red Hat
- cpe:/a:redhat:directory_server:13.2::el10 Versions 13.2 — ·Red Hat
- cpe:/a:redhat:directory_server:11 Versions 11 — ·Red Hat
- cpe:/a:redhat:directory_server:12 Versions 12 — ·Red Hat
- cpe:/a:redhat:directory_server:13 Versions 13 — ·Red Hat
- cpe:/o:redhat:rhel_els:6 Versions 6 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:8 Versions 8 — ·Red Hat
Remediation
Red Hat 17 advisories
- RHSA-2026:79217 Released 2026-10-08 · Red Hat rating Criticalredhat-ds:11 security, bug fix, and enhancement update
- Red Hat Directory Server 11.5 E4S for RHEL 8 389-ds-base-1.4.3.34-9.module+el8dsrv+24847+c94540a6.src::redhat-ds:11, 389-ds-base-1.4.3.34-9.module+el8dsrv+24847+c94540a6.x86_64::redhat-ds:11, 389-ds-base-devel-1.4.3.34-9.module+el8dsrv+24847+c94540a6.x86_64::redhat-ds:11 +5
- RHSA-2026:65119 Released 2026-09-08 · Red Hat rating ImportantRed Hat Directory Server 13.2 container image update
- Red Hat Directory Server 13.2 registry.redhat.io/dirsrv/dirsrv-container-rhel10
- RHSA-2026:64784 Released 2026-09-08 · Red Hat rating Critical389-ds-base security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) 389-ds-base-2.8.0-10.el9_8, 389-ds-base-libs-2.8.0-10.el9_8, 389-ds-base-snmp-2.8.0-10.el9_8 +1
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) 389-ds-base-devel-2.8.0-10.el9_8
Show 14 more Red Hat advisories
- RHSA-2026:64785 Released 2026-09-08 · Red Hat rating Critical389-ds-base security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 10) 389-ds-base-3.2.0-10.el10_2, 389-ds-base-libs-3.2.0-10.el10_2, 389-ds-base-snmp-3.2.0-10.el10_2 +1
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) 389-ds-base-bdb-3.2.0-10.el10_2, 389-ds-base-devel-3.2.0-10.el10_2
- RHSA-2026:64791 Released 2026-09-08 · Red Hat rating Critical389-ds:1.4 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) 389-ds-base-1.4.3.39-28.module+el8.10.0+24822+205d20dc.aarch64::389-ds:1.4, 389-ds-base-1.4.3.39-28.module+el8.10.0+24822+205d20dc.ppc64le::389-ds:1.4, 389-ds-base-1.4.3.39-28.module+el8.10.0+24822+205d20dc.s390x::389-ds:1.4 +19
- RHSA-2026:64783 Released 2026-09-08 · Red Hat rating Critical389-ds-base security, bug fix, and enhancement update
- Red Hat CodeReady Linux Builder EUS (v.9.6) 389-ds-base-devel-2.6.1-24.el9_6
- Red Hat Enterprise Linux AppStream EUS (v.9.6) 389-ds-base-2.6.1-24.el9_6, 389-ds-base-libs-2.6.1-24.el9_6, 389-ds-base-snmp-2.6.1-24.el9_6 +1
- RHSA-2026:64804 Released 2026-09-08 · Red Hat rating Critical389-ds-base security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) 389-ds-base-3.0.6-21.el10_0, 389-ds-base-libs-3.0.6-21.el10_0, 389-ds-base-snmp-3.0.6-21.el10_0 +1
- Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) 389-ds-base-bdb-3.0.6-21.el10_0, 389-ds-base-devel-3.0.6-21.el10_0
- RHSA-2026:64781 Released 2026-09-08 · Red Hat rating Critical389-ds-base security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream E4S (v.9.4) 389-ds-base-2.4.5-29.el9_4, 389-ds-base-libs-2.4.5-29.el9_4, python3-lib389-2.4.5-29.el9_4
- RHSA-2026:64778 Released 2026-09-08 · Red Hat rating Critical389-ds-base security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) 389-ds-base-2.2.4-22.el9_2, 389-ds-base-libs-2.2.4-22.el9_2, python3-lib389-2.2.4-22.el9_2
- RHSA-2026:64776 Released 2026-09-08 · Red Hat rating Critical389-ds:1.4 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) 389-ds-base-1.4.3.35-21.module+el8.8.0+24788+bed99f90.ppc64le::389-ds:1.4, 389-ds-base-1.4.3.35-21.module+el8.8.0+24788+bed99f90.src::389-ds:1.4, 389-ds-base-1.4.3.35-21.module+el8.8.0+24788+bed99f90.x86_64::389-ds:1.4 +9
- Red Hat Enterprise Linux AppStream TUS (v.8.8) 389-ds-base-1.4.3.35-21.module+el8.8.0+24788+bed99f90.src::389-ds:1.4, 389-ds-base-1.4.3.35-21.module+el8.8.0+24788+bed99f90.x86_64::389-ds:1.4, 389-ds-base-devel-1.4.3.35-21.module+el8.8.0+24788+bed99f90.x86_64::389-ds:1.4 +4
- RHSA-2026:64790 Released 2026-09-08 · Red Hat rating Critical389-ds:1.4 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) 389-ds-base-1.4.3.34-12.module+el8.6.0+24796+4783e9a9.src::389-ds:1.4, 389-ds-base-1.4.3.34-12.module+el8.6.0+24796+4783e9a9.x86_64::389-ds:1.4, 389-ds-base-devel-1.4.3.34-12.module+el8.6.0+24796+4783e9a9.x86_64::389-ds:1.4 +4
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) 389-ds-base-1.4.3.34-12.module+el8.6.0+24796+4783e9a9.src::389-ds:1.4, 389-ds-base-1.4.3.34-12.module+el8.6.0+24796+4783e9a9.x86_64::389-ds:1.4, 389-ds-base-devel-1.4.3.34-12.module+el8.6.0+24796+4783e9a9.x86_64::389-ds:1.4 +4
- RHSA-2026:64789 Released 2026-09-08 · Red Hat rating Critical389-ds:1.4 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) 389-ds-base-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.src::389-ds:1.4, 389-ds-base-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64::389-ds:1.4, 389-ds-base-devel-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64::389-ds:1.4 +4
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) 389-ds-base-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.src::389-ds:1.4, 389-ds-base-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64::389-ds:1.4, 389-ds-base-devel-1.4.3.34-7.module+el8.4.0+24797+f0b70e95.x86_64::389-ds:1.4 +4
- RHSA-2026:64793 Released 2026-09-08 · Red Hat rating Criticalredhat-ds:11 security, bug fix, and enhancement update
- Red Hat Directory Server 11.9 for RHEL 8 389-ds-base-1.4.3.39-28.module+el8dsrv+24826+9ffa737d.src::redhat-ds:11, 389-ds-base-1.4.3.39-28.module+el8dsrv+24826+9ffa737d.x86_64::redhat-ds:11, 389-ds-base-devel-1.4.3.39-28.module+el8dsrv+24826+9ffa737d.x86_64::redhat-ds:11 +5
- RHSA-2026:64780 Released 2026-09-08 · Red Hat rating Criticalredhat-ds:12 security, bug fix, and enhancement update
- Red Hat Directory Server 12.4 E4S for RHEL 9 389-ds-base-2.4.5-26.module+el9dsrv+24813+95aeb06d.src::redhat-ds:12, 389-ds-base-2.4.5-26.module+el9dsrv+24813+95aeb06d.x86_64::redhat-ds:12, 389-ds-base-devel-2.4.5-26.module+el9dsrv+24813+95aeb06d.x86_64::redhat-ds:12 +4
- RHSA-2026:64792 Released 2026-09-08 · Red Hat rating Criticalredhat-ds:11 security, bug fix, and enhancement update
- Red Hat Directory Server 11.7 E4S for RHEL 8 389-ds-base-1.4.3.34-18.module+el8dsrv+24812+0acb1821.src::redhat-ds:11, 389-ds-base-1.4.3.34-18.module+el8dsrv+24812+0acb1821.x86_64::redhat-ds:11, 389-ds-base-devel-1.4.3.34-18.module+el8dsrv+24812+0acb1821.x86_64::redhat-ds:11 +5
- RHSA-2026:64779 Released 2026-09-08 · Red Hat rating Criticalredhat-ds:12 security, bug fix, and enhancement update
- Red Hat Directory Server 12.2 E4S for RHEL 9 389-ds-base-2.2.7-18.module+el9dsrv+24814+6d9b6eb5.src::redhat-ds:12, 389-ds-base-2.2.7-18.module+el9dsrv+24814+6d9b6eb5.x86_64::redhat-ds:12, 389-ds-base-devel-2.2.7-18.module+el9dsrv+24814+6d9b6eb5.x86_64::redhat-ds:12 +4
- RHSA-2026:64771 Released 2026-09-08 · Red Hat rating Critical389-ds-base security, bug fix, and enhancement update
- Red Hat Enterprise Linux Server (v. 7 ELS) 389-ds-base-1.3.11.1-15.el7_9, 389-ds-base-libs-1.3.11.1-15.el7_9
- Red Hat Enterprise Linux Server Optional (v. 7 ELS) 389-ds-base-1.3.11.1-15.el7_9, 389-ds-base-devel-1.3.11.1-15.el7_9, 389-ds-base-libs-1.3.11.1-15.el7_9 +1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Red Hat Directory Server 11, Red Hat Directory Server 11.5 E4S for RHEL 8 and 22 more products — RHSA-2026:64779
5 records Highest priority Priority MEDIUM 3 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-15471 Improper authentication in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 44
- TI-2026-15160 NULL pointer dereference in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 40
- TI-2026-16091 389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editorPriority LOW 39
- Advisory ·
Red Hat Directory Server 11, Red Hat Directory Server 11.5 E4S for RHEL 8 and 22 more products — RHSA-2026:64780
5 records Highest priority Priority MEDIUM 3 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-15471 Improper authentication in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 44
- TI-2026-15160 NULL pointer dereference in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 40
- TI-2026-16091 389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editorPriority LOW 39
Show 11 more groups
- Advisory ·
Red Hat Directory Server 11, Red Hat Directory Server 11.5 E4S for RHEL 8 and 22 more products — RHSA-2026:64792
5 records Highest priority Priority MEDIUM 3 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-15471 Improper authentication in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 44
- TI-2026-15160 NULL pointer dereference in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 40
- TI-2026-16091 389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editorPriority LOW 39
- Advisory ·
Red Hat Directory Server 11, Red Hat Directory Server 11.5 E4S for RHEL 8 and 22 more products — RHSA-2026:64793
5 records Highest priority Priority MEDIUM 3 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-15471 Improper authentication in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 44
- TI-2026-15160 NULL pointer dereference in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 40
- TI-2026-16091 389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editorPriority LOW 39
- Advisory ·
Red Hat Directory Server 11.5 E4S for RHEL 8, Red Hat Directory Server 11.7 E4S for RHEL 8 and 21 more products — RHSA-2026:64771
4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-15471 Improper authentication in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 44
- TI-2026-15160 NULL pointer dereference in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 40
- TI-2026-15090 Integer underflow in Red Hat Directory Server 11.5 E4S for RHEL 8Priority LOW 36
- Advisory ·
Red Hat Directory Server 11.5 E4S for RHEL 8, Red Hat Directory Server 11.7 E4S for RHEL 8 and 21 more products — RHSA-2026:64776
4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-15471 Improper authentication in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 44
- TI-2026-15160 NULL pointer dereference in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 40
- TI-2026-15090 Integer underflow in Red Hat Directory Server 11.5 E4S for RHEL 8Priority LOW 36
- Advisory ·
Red Hat Directory Server 11.5 E4S for RHEL 8, Red Hat Directory Server 11.7 E4S for RHEL 8 and 21 more products — RHSA-2026:64778
4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-15471 Improper authentication in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 44
- TI-2026-15160 NULL pointer dereference in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 40
- TI-2026-15090 Integer underflow in Red Hat Directory Server 11.5 E4S for RHEL 8Priority LOW 36
- Advisory ·
Red Hat Directory Server 11.5 E4S for RHEL 8, Red Hat Directory Server 11.7 E4S for RHEL 8 and 21 more products — RHSA-2026:64781
4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-15471 Improper authentication in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 44
- TI-2026-15160 NULL pointer dereference in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 40
- TI-2026-15090 Integer underflow in Red Hat Directory Server 11.5 E4S for RHEL 8Priority LOW 36
- Advisory ·
Red Hat Directory Server 11.5 E4S for RHEL 8, Red Hat Directory Server 11.7 E4S for RHEL 8 and 21 more products — RHSA-2026:64783
4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-15471 Improper authentication in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 44
- TI-2026-15160 NULL pointer dereference in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 40
- TI-2026-15090 Integer underflow in Red Hat Directory Server 11.5 E4S for RHEL 8Priority LOW 36
- Advisory ·
Red Hat Directory Server 11.5 E4S for RHEL 8, Red Hat Directory Server 11.7 E4S for RHEL 8 and 21 more products — RHSA-2026:64789
4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-15471 Improper authentication in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 44
- TI-2026-15160 NULL pointer dereference in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 40
- TI-2026-15090 Integer underflow in Red Hat Directory Server 11.5 E4S for RHEL 8Priority LOW 36
- Advisory ·
Red Hat Directory Server 11.5 E4S for RHEL 8, Red Hat Directory Server 11.7 E4S for RHEL 8 and 21 more products — RHSA-2026:64790
4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-15471 Improper authentication in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 44
- TI-2026-15160 NULL pointer dereference in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 40
- TI-2026-15090 Integer underflow in Red Hat Directory Server 11.5 E4S for RHEL 8Priority LOW 36
- Advisory ·
Red Hat Directory Server 11.5 E4S for RHEL 8, Red Hat Directory Server 11.7 E4S for RHEL 8 and 21 more products — RHSA-2026:64791
4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-15471 Improper authentication in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 44
- TI-2026-15160 NULL pointer dereference in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 40
- TI-2026-15090 Integer underflow in Red Hat Directory Server 11.5 E4S for RHEL 8Priority LOW 36
- Advisory ·
Red Hat Directory Server 11.5 E4S for RHEL 8, Red Hat Directory Server 11.7 E4S for RHEL 8 and 21 more products — RHSA-2026:64804
4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-15471 Improper authentication in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 44
- TI-2026-15160 NULL pointer dereference in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 40
- TI-2026-15090 Integer underflow in Red Hat Directory Server 11.5 E4S for RHEL 8Priority LOW 36
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Directory Server 11 | Affected | No fix yet |
| Red Hat Directory Server 12 | Affected | No fix yet |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat CodeReady Linux Builder EUS (v.9.6) | Fixed | RHSA-2026:64783 |
| Red Hat Directory Server 11.5 E4S for RHEL 8 | Fixed | RHSA-2026:79217 |
| Red Hat Directory Server 11.7 E4S for RHEL 8 | Fixed | RHSA-2026:64792 |
| Red Hat Directory Server 11.9 for RHEL 8 | Fixed | RHSA-2026:64793 |
| Red Hat Directory Server 12.2 E4S for RHEL 9 | Fixed | RHSA-2026:64779 |
| Red Hat Directory Server 12.4 E4S for RHEL 9 | Fixed | RHSA-2026:64780 |
| Red Hat Directory Server 13.2 | Fixed | RHSA-2026:65119 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:64785 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:64791 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:64784 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2026:64789 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2026:64790 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2026:64776 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2026:64778 |
| Red Hat Enterprise Linux AppStream E4S (v.9.4) | Fixed | RHSA-2026:64781 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:64804 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:64783 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) | Fixed | RHSA-2026:64789 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | Fixed | RHSA-2026:64790 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2026:64776 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Fixed | RHSA-2026:64785 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) | Fixed | RHSA-2026:64784 |
| Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) | Fixed | RHSA-2026:64804 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2026:64771 |
| Red Hat Enterprise Linux Server Optional (v. 7 ELS) | Fixed | RHSA-2026:64771 |
Not affected: 1 product
- Red Hat Directory Server 13
Timeline
- 2026-10-02 Threatist record created from CVE-2026-76560
- 2026-10-03 Alias added: GHSA-g4xg-g9jg-549h
- 2026-10-08 Fix available: redhat-ds:[email protected] · CNA
- 2026-10-08 1 new reference · CNA
- 2026-10-09 Fix available: RHSA-2026:79217 · Red Hat
- 2026-10-09 Fix available: Red Hat Directory Server 11.5 E4S for RHEL 8 · Red Hat
References
Advisory 17
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-76560 · CVE Program
- CVE-2026-76560 · NVD
- FIRST EPSS
- GHSA-g4xg-g9jg-549h · GitHub Advisory Database · CC BY 4.0
- CVE-2026-76560 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences