389 Directory Server CVE-2026-18651

Exploitation requires the attacker to possess the correct, current password for the targeted account - the administrative account lock does not change or invalidate the stored password credential. The target account must have been locked via the administrative lock mechanism (nsAccountLock attribute set by an administrator), not solely through a password-policy intruder lockout (behavior for the latter is not addressed by this CVE). The SASL PLAIN mechanism must be enabled and accepted by the server (a common but not universal configuration). After receiving the bind-failure response, the attacker's LDAP client must continue issuing operations on the same connection rather than disconnecting on error - standard compliant clients typically disconnect, so exploitation likely requires a custom client or library that can ignore the bind error. The authenticated state persists only for the duration of that specific TCP connection; a new connection attempt will trigger the same failing bind. Exploitation is bounded to the locked account's ACL-granted privileges, which limits the attacker to whatever directory access the account had before revocation.

CVSS 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N captures this accurately. The network vector and low complexity reflect that exploitation requires only a TCP connection to the LDAP port and no special timing or race condition - it is a deterministic sequencing flaw, not a race. PR:L is the critical limiting factor: the attacker must possess valid (correct) password credentials for the target account; the account lock does not invalidate the password. This means exploitation is primarily relevant in two scenarios: terminated employees who retained knowledge of their credentials after an administrator locked (but did not delete) their account, and incident-response situations where a compromised account is locked rather than immediately deleted or password-reset. The scope is unchanged (S:U), so the attacker cannot leverage this flaw to escalate beyond the locked account's existing ACL grants. No EPSS data was provided; the absence of both a KEV listing and a known POC suggests opportunistic exploitation is not currently occurring. Real-world risk is moderate for organizations using account-lock as a sole revocation control; negligible for organizations that supplement locking with password resets or account deletion.

A terminated employee whose LDAP account has been administratively locked but whose password has not been changed opens a new LDAP connection to the directory server and submits a SASL PLAIN bind with their former valid credentials. The server internally marks the connection as authenticated before running the lock check, returns a bind-failure error, but the attacker's LDAP client - or a custom script - suppresses the error and immediately issues LDAP search or modify operations on the now-open connection. The attacker successfully reads or modifies directory entries within the bounds of their former account's ACL grants for the lifetime of that TCP connection. No public exploit code has been identified at time of analysis.