Red Hat IPA EUVD-2026-63246

Exploitation requires a valid LDAP bind credential against the affected 389 Directory Server instance hosting the ipa-enrollment SLAPI plugin - this aligns with CVSS PR:L (low privileges). The target server must have the ipa-enrollment SLAPI plugin loaded, which is present when the ipa-server package is installed and the IPA server role is active. The attacker must be able to reach TCP port 389 or 636 on the IPA master or replica. The specific trigger is omitting the request value for the JOIN_OID in an LDAP extended operation request. Exploitation is limited by: (1) the requirement for at least a low-privilege authenticated LDAP session, ruling out unauthenticated external attackers without credentials; (2) the need for network access to the directory server port, which is typically restricted to the internal network or IdM clients; (3) impact is confined to availability only - no data exfiltration or persistent code execution is possible via this vector.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 6.5 and accurately characterizes the threat: network-reachable, low complexity, but gated behind at minimum low-privilege authentication (PR:L - a valid LDAP bind). This is a DoS-only vulnerability with no confidentiality or integrity impact, limiting its severity relative to code execution flaws. Real-world risk is moderate: any authenticated user in a Red Hat IdM domain could repeatably crash the directory server, which would disrupt Kerberos authentication, DNS, sudo policy enforcement, and certificate services across the domain. EPSS data is not included in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no POC is confirmed, suggesting no active exploitation at time of analysis. The main risk elevation factor is the scope of downstream impact - a crashed 389 Directory Server is not just an LDAP outage but a full IdM control-plane failure for the domain.

An attacker who possesses any valid LDAP credential in the Red Hat IdM domain - including a low-privilege domain user - connects to the 389 Directory Server on TCP port 389 or 636 and sends a crafted LDAP extended operation request for the JOIN_OID with the request value field intentionally omitted from the BER encoding. The ipa-enrollment SLAPI plugin attempts to dereference the null request value pointer, triggering a process crash that brings down the directory server and disrupts all IdM-dependent services across the domain. No public POC has been confirmed, but the trigger condition (omitting a BER field) is trivially reproducible with standard LDAP libraries.