Critical RHSA-2026:64811 1 CVE

Red Hat Security Advisory: 389-ds-base security update

Published Sep 8, 2026 · Updated Oct 19, 2026

Ecosystem: Red Hat

Fixed packages 4

Release	Package	Fixed in
Red Hat · RHEL 6 ELS rhel_els:6	389-ds-base	0:1.2.11.15-97.el6_10.1
Red Hat · RHEL 6 ELS rhel_els:6	389-ds-base-debuginfo	0:1.2.11.15-97.el6_10.1
Red Hat · RHEL 6 ELS rhel_els:6	389-ds-base-devel	0:1.2.11.15-97.el6_10.1
Red Hat · RHEL 6 ELS rhel_els:6	389-ds-base-libs	0:1.2.11.15-97.el6_10.1

Vulnerabilities 1

Critical 9.8

CVE-2026-18922

389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regard…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux

Sep 7, 2026

References

article
https://access.redhat.com/security/updates/classification/#critical
report
https://bugzilla.redhat.com/show_bug.cgi?id=2511388
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_64811.json
report
https://access.redhat.com/security/cve/CVE-2026-18922
advisory
https://www.cve.org/CVERecord?id=CVE-2026-18922
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-18922