Dogtag PKI CVE-2026-76561

Exploitation requires a valid, authenticated CA Administrator account within Dogtag PKI - this is PR:H per the CVSS vector. The attacker must be able to reach the Dogtag PKI web interface over the network (AV:N). The ExternalProcessConstraint mechanism must be available (it is a standard, built-in Dogtag feature, not a non-default plugin). No user interaction beyond the attacker's own administrative session is needed (UI:N). Limiting factors: CA Administrator is a highly privileged role that should be tightly controlled in any PKI deployment; an attacker without this credential cannot exploit this vulnerability. Exploitation is constrained to the pkiuser OS account - it does not directly yield root, though pkiuser on a CA server has significant operational authority over the certificate infrastructure.

The CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) accurately reflects the constraint that CA Administrator credentials are required (PR:H), which substantially narrows the attack surface compared to unauthenticated vulnerabilities. In practice, CA Administrators are already highly trusted roles in enterprise PKI deployments, so exploitation typically represents insider threat, compromised admin credential, or privilege escalation from a lower-trust role. No EPSS data was provided; CISA KEV status is not confirmed; no public proof-of-concept is known at time of analysis. Despite the high C/I/A ratings, the real-world priority tier is moderate - organizations should patch promptly but the exploitable population (those with CA Administrator access) is small. The scope is unchanged (S:U), meaning execution lands on the Dogtag/pkiuser account rather than escaping to a broader system boundary, though pkiuser access on a CA host is itself highly sensitive given certificate issuance authority.

An attacker who has obtained CA Administrator credentials - through phishing, credential stuffing, or lateral movement - connects to the Dogtag PKI web interface over HTTPS and uploads a specially crafted certificate profile XML containing an ExternalProcessConstraint block with attacker-controlled environment variables that embed shell metacharacters or commands. Dogtag validates only the profile ID, accepts the malicious content, and subsequently invokes the external process with the injected environment, executing arbitrary commands as the pkiuser OS account on the CA host. No public proof-of-concept is known, but the exploit path is straightforward for anyone with CA Administrator access and knowledge of the ExternalProcessConstraint configuration format.