389 Directory Server EUVD-2026-35422

Exploitation requires the attacker to hold high-privilege write access to stored password hash entries in the 389 Directory Server - specifically, write permission on the userPassword attribute for the target LDAP entry, which typically means Directory Manager-level credentials or explicitly delegated ACL write rights on that attribute. This is confirmed by the CVSS PR:H rating. The vulnerability is triggered by the standard LDAP BIND (authentication) operation against the tampered account - no non-default configuration, special authentication plugin activation, or unusual deployment mode is required. Standard user-level LDAP accounts with only bind (read) access cannot exploit this vulnerability. The attack is further limited to availability impact only, with no mechanism for data exfiltration or hash cracking inherent in this flaw. There is no required interaction from the victim user beyond performing a normal login.

CVSS 4.9 (Medium) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. The High privilege requirement (PR:H) is the dominant risk-limiting factor: the attacker must already possess Directory Manager-level or delegated write access to the userPassword attribute - a position that implies significant prior compromise or insider threat. The network attack vector (AV:N) and low attack complexity (AC:L) indicate exploitation requires no special conditions beyond the privilege prerequisite, but that prerequisite is itself a high bar. No EPSS data was provided in the intelligence feed, so probabilistic exploitation likelihood cannot be quantified. The absence of a KEV listing and no identified POC further suggest this is not being actively targeted in the wild. The impact is a pure denial of service with no data exposure risk (C:N/I:N), making it a lower-priority item for most organizations compared to high-privilege issues with confidentiality or integrity impact. Organizations with shared multi-tenant directory environments or concerns about compromised admin credentials should treat this more urgently.

An attacker with compromised Directory Manager credentials authenticates to the 389 Directory Server over LDAP (AV:N, PR:H) and issues an LDAP modify operation to overwrite a target service account's userPassword attribute with a crafted PBKDF2-SHA256 hash embedding an iteration count in the billions. Every subsequent authentication attempt by that service account - or by any process binding as that account - triggers a CPU-saturating PBKDF2 computation on the LDAP server, potentially rendering the directory unresponsive to all clients. No public exploit code has been identified at time of analysis.