CVE catalog

CVE-2026-76561

UBUNTU-CVE-2026-76561

[CVE catalog]

Severity
High · CVSS 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.73% · Oct 25, 2026

A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's ExternalProcessConstraint mechanism to execute arbitrary commands with attacker-controlled environment variables, achieving code execution as the pkiuser account.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntudogtag-pkipro10.2.6-1vulnerable
Ubuntudogtag-pkipro10.2.6-2vulnerable
Ubuntudogtag-pkipro10.2.6-3vulnerable
Ubuntudogtag-pkipro10.2.6+git20160317-1vulnerable
Ubuntudogtag-pkipro10.2.6+git20160317-1ubuntu0.1~esm1vulnerable
Ubuntudogtag-pkipro10.3.5+12-4ubuntu1vulnerable
Ubuntudogtag-pkipro10.3.5+12-5vulnerable
Ubuntudogtag-pkipro10.5.3-3vulnerable
Ubuntudogtag-pkipro10.5.3-4vulnerable
Ubuntudogtag-pkipro10.5.5-1vulnerable
Ubuntudogtag-pkipro10.6.0~beta2-3vulnerable
Ubuntudogtag-pkipro10.6.0-1ubuntu1vulnerable
Ubuntudogtag-pkipro10.6.0-1ubuntu2vulnerable
Ubuntudogtag-pkipro10.6.0-1ubuntu2+esm1vulnerable
Ubuntudogtag-pkipro10.7.3-4vulnerable
Ubuntudogtag-pkipro10.8.3-1ubuntu1vulnerable
Ubuntudogtag-pkipro10.8.3-1ubuntu1+esm1vulnerable
Ubuntudogtag-pkipro10.10.2-3build1vulnerable
Ubuntudogtag-pkipro11.0.0-1vulnerable
Ubuntudogtag-pkipro11.0.0-1ubuntu0.1~esm1vulnerable

Fixed-version evidence

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]