CVE-2026-18922 Auth bypass in Red Hat Directory Server 11.5 E4S for RHEL 8
Attackers can escalate privileges to Directory Manager by exploiting stale SASL identity states during authentication sequences.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-18922?
CVE-2026-18922 is a critical authentication bypass vulnerability in Red Hat Directory Server 11.5 E4S for RHEL 8, published on 7 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.
Weakness: CWE-287
Which versions are affected by CVE-2026-18922?
Linux distribution packages (4)
389-ds-base Red Hat:rhel_els:6 | All versions | 0:1.2.11.15-97.el6_10.1 |
389-ds-base-debuginfo Red Hat:rhel_els:6 | All versions | 0:1.2.11.15-97.el6_10.1 |
389-ds-base-devel Red Hat:rhel_els:6 | All versions | 0:1.2.11.15-97.el6_10.1 |
389-ds-base-libs Red Hat:rhel_els:6 | All versions | 0:1.2.11.15-97.el6_10.1 |
How do I fix CVE-2026-18922?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-18922 being exploited?
There is no known exploitation of CVE-2026-18922 in the wild and no public exploit code.
Sources
Also known as AZL-99983, DEBIAN-CVE-2026-18922, GHSA-pr87-24g5-hphv, RHSA-2026:64811, UBUNTU-CVE-2026-18922.