Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify LDAP service accepting anonymous binds
  2. Delivery
    Locate entry with SELFDN ACI on empty attribute
  3. Exploit
    Perform anonymous LDAP bind (empty DN)
  4. Execution
    Submit modify or add LDAP operation on target entry
  5. Persist
    SELFDN evaluator incorrectly matches empty DN to empty value
  6. Impact
    Unauthorized directory write succeeds

Vulnerability Assessment

Weakness
CWE
CWE-863
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires three concurrent conditions: (1) the directory server must permit anonymous LDAP binds, which is enabled by default in many 389-ds deployments (nsslapd-allow-anonymous-access set to on or rootdse); (2) SELFDN-type ACIs must be explicitly configured on target entries - SELFDN is not a default ACI type and requires deliberate administrator setup; (3) the specific attribute referenced by the SELFDN ACI in the target entry must currently contain an empty value, which can occur for optional schema attributes that have not yet been populated. Entries where the SELFDN-referenced attribute holds any non-empty value are not affected by this flaw. The principal limiting factors are: SELFDN ACIs are non-default and require explicit configuration; empty attribute values in SELFDN-protected entries represent a specific, often transient deployment state; and disabling anonymous LDAP binds entirely eliminates the attack path regardless of ACI configuration.
Impact

The Red Hat-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) correctly identifies this as a network-accessible, unauthenticated attack with high integrity impact and no user interaction. However, the AC:L rating is optimistic: exploitation requires the simultaneous presence of SELFDN ACIs and empty attribute values in target entries - conditions that are specific to particular deployment states such as initial provisioning or optional schema fields left unpopulated. In practice, fully populated mature directories may not expose this path at all. No EPSS data, CISA KEV listing, or public proof-of-concept is present in the available intelligence, so real-world exploitation probability cannot be independently scored. Even a mid-sized municipal IT team in opole running RHEL-based directory infrastructure should treat this as a priority review if SELFDN ACIs are in use and any target entries may carry empty attributes. The impact is integrity-only (C:N/A:N), but unauthorized LDAP modifications - such as injecting user records or altering group memberships - carry serious downstream consequences in environments using centralized LDAP for authentication and authorization decisions.
Exploit ScenarioDerived

An unauthenticated attacker with network access to the LDAP service performs an anonymous bind (empty bind DN) and submits an LDAP modify or add request targeting an entry whose SELFDN-referenced attribute is empty. The flawed evaluator matches the empty bind DN to the empty attribute value and grants the operation, allowing the attacker to inject a new directory entry or modify an existing one - for example, adding a rogue user record or altering a group membership record - using only standard LDAP client tools such as ldapmodify. No public proof-of-concept has been identified, but the technique requires no specialized tooling beyond a basic LDAP client.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 07, 2026

Unauthenticated integrity compromise in 389 Directory Server (shipped as Red Hat Directory Server 11/12/13 and bundled in RHEL 6-10) allows anonymous LDAP clients to bypass SELFDN-based access control checks. The SELFDN ACI bind-rule evaluator incorrectly equates an anonymous client's empty bind DN with an empty stored attribute value in a target directory entry, satisfying an ACI that was intended to permit only a matching authenticated identity. Exploitation enables anonymous directory modifications - including adding or altering entries - that SELFDN ACIs were designed to restrict to specific authenticated users. No public exploit has been identified at time of analysis.

RemediationAI

No specific patched version is confirmed from the available references - monitor the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-76560 and Bugzilla ID 2519521 for errata releases. As an immediate compensating control, audit all SELFDN ACIs in the directory and identify any target entries where the SELFDN-referenced attribute contains an empty value; populate those attributes with a non-empty value or remove the SELFDN ACI from entries with unpopulated attributes, since the flaw only triggers when the stored value is empty. A more aggressive but highly effective control is to disable anonymous LDAP binds entirely by setting nsslapd-allow-anonymous-access to rootdse or off - this eliminates the unauthenticated attack vector completely, though it may break applications that rely on anonymous reads for schema discovery or public attributes and will require those applications to use authenticated service accounts instead. No upstream community (Fedora 389-ds-base) fix version is referenced in the available data.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

389 Directory Server implements LDAP access control via Access Control Instructions (ACIs). The SELFDN bind-rule type is an owner-based mechanism: it grants an operation only when the requesting client's bind DN matches a specific DN stored in the target entry's attribute, effectively limiting write access to the entry's 'owner.' The CWE-863 (Incorrect Authorization) root cause lies in the SELFDN evaluator logic: an anonymous bind produces an empty bind DN string, and when the referenced attribute in the target entry also happens to contain an empty value, the evaluator incorrectly treats these as a match and grants access rather than rejecting the unauthenticated session. Affected products per CPE include cpe:2.3:a:red_hat:red_hat_directory_server_11, _12, and _13, as well as 389-ds-base as distributed across Red Hat Enterprise Linux 6 through 10.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
vuln.today AI 5.9 MEDIUM

AC:H reflects the specific prerequisite that target entries must have empty SELFDN-referenced attribute values; all other vendor metrics are retained.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE 8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Red Hat 7.5 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

DescriptionCVE.org

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated identity. This can allow an anonymous LDAP client to perform an operation, such as adding or modifying a directory entry, that a SELFDN-based ACI intended to restrict to a specific authenticated user.

Executive ViewAI

Why It Matters

Red Hat Directory Server (versions 11-13) and RHEL systems (versions 6-10) running 389 Directory Server allow unauthenticated attackers to bypass access controls and modify critical directory data. Affected organizations rely on these directory services for authentication, authorization, and identity management; attackers could alter user accounts, service configurations, and organizational identity information. This threatens both operational stability and regulatory compliance across enterprises using vulnerable Red Hat infrastructure.

Business Impact: High
Compensating Controls

Until a vendor patch is released, implement: (1) Disable anonymous LDAP binds and enforce authentication for all directory access; (2) Network-level access controls restricting LDAP ports 389 and 636 to authorized internal networks; (3) Audit and remove SELFDN-based ACIs that unnecessarily permit anonymous access; (4) Deploy comprehensive LDAP access and modification logging with real-time alerting for anomalous activity; (5) Implement network segmentation to isolate directory servers from untrusted network segments and enforce defense-in-depth.

Threat Intelligence Overview

EPSS Score
0.4%
Top 70% exploitable
Prevalence
Medium
enterprise RHEL LDAP stack, common in Red Hat shops
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.4%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_directory_server_11:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_directory_server_11:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_directory_server_12:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_directory_server_12:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_directory_server_13:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2026-71362 CRITICAL POC
9.1
CVE-2026-42016 HIGH POC
8.8
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-76560 ADVISORY https://vuldb.com/vuln/399593 REF https://access.redhat.com/errata/RHSA-2026:64771 REF https://access.redhat.com/errata/RHSA-2026:64776 REF https://access.redhat.com/errata/RHSA-2026:64778 REF https://access.redhat.com/errata/RHSA-2026:64779 REF https://access.redhat.com/errata/RHSA-2026:64780 REF https://access.redhat.com/errata/RHSA-2026:64781 REF https://access.redhat.com/errata/RHSA-2026:64783 REF https://access.redhat.com/errata/RHSA-2026:64784 REF https://access.redhat.com/errata/RHSA-2026:64785 REF https://access.redhat.com/errata/RHSA-2026:64789 REF https://access.redhat.com/errata/RHSA-2026:64790 REF https://access.redhat.com/errata/RHSA-2026:64791 REF https://access.redhat.com/errata/RHSA-2026:64792 REF https://access.redhat.com/errata/RHSA-2026:64793 REF https://access.redhat.com/errata/RHSA-2026:64804 REF https://access.redhat.com/errata/RHSA-2026:65119 REF https://access.redhat.com/errata/RHSA-2026:79217 REF https://access.redhat.com/security/cve/CVE-2026-76560 REF https://bugzilla.redhat.com/show_bug.cgi?id=2519521

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy