Status: UPDATED
| Advisory ID: CVE-2026-11861
Key Details
| CVE | CVE-2026-11861 |
| CVSS Score / Version | 9.6 (Critical) / CVSS v3.1 |
| Updated | 2026-09-28 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
| CVSS Prose | attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is none. |
| Affected products | see table below |
| Classified as | CWE-266 (Incorrect Privilege Assignment) |
Affected Products, Subsystems & Sectors
| Subsystems | OT Supporting Infrastructure |
| Sectors | All Sectors |
What to Know
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain. (NVD)
What to Do
Monitor Red Hat's and freeipa's web pages for any future patch releases. See vendor advisory link below.
References