389 Directory Server CVE-2026-11884

No specific fixed package version is confirmed in the available data; monitor https://access.redhat.com/security/cve/CVE-2026-11884 and the Bugzilla tracker at https://bugzilla.redhat.com/show_bug.cgi?id=2484913 for errata publication. Because this is an incomplete fix of CVE-2025-14905, when a patch becomes available verify through release notes or the Bugzilla entry that it explicitly addresses the oc_superior (SUP) field in both read_schema_dse() and schema_oc_to_string() - applying a patch that only covers the original CVE-2025-14905 code path will not remediate this variant. As compensating controls prior to patching: restrict the Directory Manager bind DN and any accounts with schema write ACIs to the minimum operationally required set, and audit current privilege grants using the directory's ACI configuration; rotate Directory Manager credentials if there is any suspicion of compromise, as credential theft is the primary realistic enabler. Harden replication topology by reviewing all configured replication supplier agreements and removing any suppliers that are no longer operationally required, since a compromised supplier represents a second trigger path that bypasses normal credential controls. Placing the LDAP service behind network controls that restrict administrative port access (typically 636/389) to known management hosts reduces the effective network attack surface, though this does not eliminate risk from already-privileged insiders.