Perl DBI CVE-2026-19546

Exploitation requires a low-privilege authenticated session to the affected application or service that relies on the Perl DBI module on RHEL. The CVSS vector PR:L confirms authentication is required - unauthenticated exploitation is not supported by the available data. The target system must be running the partially-patched DBI package (i.e., the CVE-2026-14380 fix applied but this follow-on fix not yet applied) on RHEL 9.8.z or 10.2.z as specifically noted in the description. The attack is network-accessible (AV:N) with no user interaction required. Limiting factors: requires authenticated access, and only systems in the specific patch-level gap between CVE-2026-14380 remediation and this fix are exposed.

The CVSS 8.8 score is consistent with the vector metrics: network reachable, low complexity, low-privilege authentication required, and full high-impact triad (C:H/I:H/A:H). The PR:L metric is the primary mitigating factor - exploitation requires some authenticated foothold, which narrows the attacker population compared to PR:N vulnerabilities. No EPSS score was provided in the input, and no KEV listing or public POC is identified, so active exploitation is not confirmed. The 'incomplete fix' nature of this CVE is a notable risk amplifier: environments that applied the CVE-2026-14380 patch but have not yet applied this follow-on fix believe themselves patched but remain exposed - a gap that even a mid-sized IT operations team should treat as urgent to close promptly. The scope of affected RHEL versions (6 through 10 per CPE data) is broad, though RHEL 6 and 7 are end-of-life, meaning patches may only be available under extended support contracts. Conflicting signal: the description references RHEL 9.8.z and 10.2.z specifically, while CPE strings span RHEL 6 through 10 - the true remediation scope should be verified against the Red Hat advisory directly.

An attacker with a low-privilege authenticated account on an application backed by Perl DBI sends a specially crafted input that bypasses the incomplete sanitization introduced in the CVE-2026-14380 fix, reaching a dynamic code execution pathway within DBI. The injected payload executes with the privileges of the application or database service process. No public POC is identified at time of analysis, but the CWE-94 classification and prior partial-fix history suggest the injection vector is non-trivial to discover but achievable through source code analysis of the original and incomplete patches.