What’s Vulnerable › Vulnerabilities

CVE-2026-76561: Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-08 · updated 2026-10-21
• Weakness: CWE-78

Description

A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's ExternalProcessConstraint mechanism to execute arbitrary commands with attacker-controlled environment variables, achieving code execution as the pkiuser account.

Affected products

• Red Hat Certificate System 9: all versions
• Red Hat Enterprise Linux 10: all versions — fixed in 0:11.9.0-5.el10_2
• Red Hat Enterprise Linux 10.0 Extended Update Support: all versions — fixed in 0:11.6.0-3.el10_0.1
• Red Hat Enterprise Linux 7: all versions
• Red Hat Enterprise Linux 8: all versions — fixed in 8100020260930154041.82f485b7
• Red Hat Enterprise Linux 9: all versions — fixed in 0:11.7.1-2.el9_8
• Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: all versions — fixed in 0:11.3.0-3.el9_2
• Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: all versions — fixed in 0:11.5.0-3.el9_4
• Red Hat Enterprise Linux 9.6 Extended Update Support: all versions — fixed in 0:11.6.0-4.el9_6

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 10 0:11.9.0-5.el10_2; Red Hat Enterprise Linux 10.0 Extended Update Support 0:11.6.0-3.el10_0.1; Red Hat Enterprise Linux 8 8100020260930154041.82f485b7; Red Hat Enterprise Linux 9 0:11.7.1-2.el9_8; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:11.3.0-3.el9_2; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:11.5.0-3.el9_4; Red Hat Enterprise Linux 9.6 Extended Update Support 0:11.6.0-4.el9_6. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:73765
• https://access.redhat.com/errata/RHSA-2026:73766
• https://access.redhat.com/errata/RHSA-2026:75573
• https://access.redhat.com/errata/RHSA-2026:86621
• https://access.redhat.com/errata/RHSA-2026:86623
• https://access.redhat.com/errata/RHSA-2026:86624
• https://access.redhat.com/errata/RHSA-2026:86625
• https://access.redhat.com/security/cve/CVE-2026-76561
• https://bugzilla.redhat.com/show_bug.cgi?id=2519523

Get alerted when CVE-2026-76561 or the next vulnerability affects your stack