Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach LDAP bind endpoint over network
  2. Delivery
    Send SASL PLAIN bind as cn=Directory Manager with wrong password
  3. Exploit
    Complete SASL ANONYMOUS bind on same connection
  4. Execution
    Stale Directory Manager identity installed
  5. Impact
    Exercise full directory read/write as admin

Vulnerability Assessment

Weakness
CWE
CWE-287
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK

2 techniques across 2 tactics: Defense Evasion, Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires network reachability to a 389 Directory Server / Red Hat Directory Server LDAP endpoint that accepts SASL binds, and specifically that SASL PLAIN plus a second completing mechanism (SASL ANONYMOUS, or a valid low-privileged account's own successful bind) are available on the same connection. The attacker needs no valid credentials for the target identity (CVSS PR:N) and no user interaction. Limiting factors: both bind steps must occur on one persistent connection; if SASL ANONYMOUS is disabled the anonymous variant is blocked, though the variant using a legitimate low-privileged account's successful bind still applies, and that variant requires possession of any one valid account.
Impact

This is a genuine high-priority issue rather than an inflated high-CVSS score. The 9.8 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) is consistent with the description: a remote, unauthenticated attacker can escalate to Directory Manager - the directory's root-equivalent account - using nothing more than two ordinary LDAP bind operations on one connection, with no special timing or race. Impact is maximal because Directory Manager can read, modify, and delete all directory data, and a directory server typically anchors identity for many downstream systems, so compromise cascades. There is no EPSS score, KEV entry, or public PoC in the provided data, so exploitation is currently theoretical, but the low complexity means defenders should not wait for in-the-wild activity - any operator running an exposed 389-ds/RHDS instance should treat this as urgent and patch as soon as a fix is published. The absence of exploitation signals should be read as 'not yet observed,' not 'unlikely.'
Exploit ScenarioDerived

An attacker with only network reachability to the LDAP port opens a single connection, issues a SASL PLAIN bind as cn=Directory Manager with a deliberately wrong password (which fails), then issues a SASL ANONYMOUS bind on the same connection. The server installs the stale Directory Manager identity and grants full administrative authority, letting the attacker read or rewrite the entire directory, including account credentials and access-control data. No public PoC is currently identified, but the sequence is trivial to script against any reachable instance.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 07, 2026

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remote unauthenticated attackers assume Directory Manager authority without valid credentials. A stale SASL auxiliary identity left over from a failed SASL PLAIN bind is incorrectly installed onto the connection when a later, unrelated bind (e.g. SASL ANONYMOUS) succeeds on the same connection. No public exploit was identified at time of analysis, and the flaw is not listed in CISA KEV, but the trivially reproducible bind sequence makes weaponization straightforward.

RemediationAI

No vendor-released patch version is identified in the available data; monitor the Red Hat CVE page (https://access.redhat.com/security/cve/CVE-2026-18922) and Bugzilla 2511388 for the fixed 389-ds-base package NVRs for each RHEL and RHDS stream, then upgrade via the normal errata channel once published. As compensating controls until patched: restrict network access to the LDAP/LDAPS ports (389/636) so only trusted management hosts can reach the directory, which limits the unauthenticated remote surface but does not stop an attacker already inside that network segment; disable the SASL ANONYMOUS mechanism (and review whether SASL PLAIN is required) via the server's allowed-SASL-mechanism configuration, which removes the demonstrated anonymous-bind variant but not necessarily the low-privileged-account variant and may break legitimate anonymous or PLAIN clients; and increase audit logging of bind operations to detect the failed-PLAIN-then-successful-bind pattern on a single connection.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

389 Directory Server is an LDAP directory server that delegates SASL authentication to the Cyrus SASL library. Cyrus SASL exposes an 'auxiliary property' (auxprop) store used to carry authentication identity state during a bind. The root cause (CWE-287, Improper Authentication) is that an identity written into the auxprop store during a SASL PLAIN bind attempt is not cleared when that bind fails; it persists on the connection state. When a subsequent bind completes successfully by any mechanism - even SASL ANONYMOUS, which authenticates no principal - the server binds the connection to the leftover identity rather than the identity actually proven by the second exchange. The affected CPEs cover Red Hat Directory Server 11/12/13 and the 389-ds packages in Red Hat Enterprise Linux 6 through 10.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 9.8 CRITICAL

Two ordinary LDAP binds on one connection with no credentials yield Directory Manager authority, so AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H over directory data.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE CRITICAL
Red Hat 9.8 CRITICAL

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.

Executive ViewAI

Why It Matters

Red Hat Directory Server versions 11-13 deployed on RHEL 6-10 systems are vulnerable to complete remote compromise: any unauthenticated attacker can obtain full Directory Manager administrator privileges, potentially compromising all user accounts, access permissions, and authentication services managed by the affected directory. This directly threatens business continuity for identity-dependent applications and access controls across affected enterprise infrastructure.

Business Impact: Severe
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict LDAP access via firewall to only authorized administrative systems; disable SASL PLAIN support where operationally feasible to reduce attack surface; implement comprehensive LDAP audit logging and real-time alerting on Directory Manager authentication and privilege activity; segment affected systems from internet-facing applications and untrusted networks; monitor for suspicious bind sequences, state transitions between SASL methods, and ANONYMOUS binds followed by administrative commands.

Threat Intelligence Overview

EPSS Score
0.6%
Top 55% exploitable
Prevalence
Medium
widely used enterprise LDAP directory, bundled in RHEL and RHDS
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.6%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
Very High
Technical Impact
Total

Priority Score

50
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_directory_server_11:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_directory_server_12:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_directory_server_13:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-6732 HIGH
7.5 Apr 23

Denial of service in libxml2 allows a remote attacker to crash any application that uses the library to XSD-validate an

Same weakness CWE-287 – Improper Authentication

View all
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2023-35078 CRITICAL POC
9.8
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-18922 ADVISORY https://vuldb.com/vuln/399614 REF https://access.redhat.com/errata/RHSA-2026:64771 REF https://access.redhat.com/errata/RHSA-2026:64776 REF https://access.redhat.com/errata/RHSA-2026:64778 REF https://access.redhat.com/errata/RHSA-2026:64779 REF https://access.redhat.com/errata/RHSA-2026:64780 REF https://access.redhat.com/errata/RHSA-2026:64781 REF https://access.redhat.com/errata/RHSA-2026:64783 REF https://access.redhat.com/errata/RHSA-2026:64784 REF https://access.redhat.com/errata/RHSA-2026:64785 REF https://access.redhat.com/errata/RHSA-2026:64789 REF https://access.redhat.com/errata/RHSA-2026:64790 REF https://access.redhat.com/errata/RHSA-2026:64791 REF https://access.redhat.com/errata/RHSA-2026:64792 REF https://access.redhat.com/errata/RHSA-2026:64793 REF https://access.redhat.com/errata/RHSA-2026:64804 REF https://access.redhat.com/errata/RHSA-2026:64811 REF https://access.redhat.com/errata/RHSA-2026:79217 REF https://access.redhat.com/security/cve/CVE-2026-18922 REF https://bugzilla.redhat.com/show_bug.cgi?id=2511388

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy