High severity · published Sep 8, 2026
CVE-2026-76561
Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)
7.2
CVSS
0.7%
EPSS
No
On KEV
Description
A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's ExternalProcessConstraint mechanism to execute arbitrary commands with attacker-controlled environment variables, achieving code execution as the pkiuser account.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Certificate System 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 6 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 9.6 Extended Update Support · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-76561
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-76561
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:73765
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:73766
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:75573
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:86621
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:86623
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:86624
More from Red Hat Certificate System 9
6.5
CVE-2026-11873
Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure
6.5
CVE-2026-18047
Dogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slash
5.8
CVE-2026-18369
Dogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects
5.3
CVE-2026-53682
Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts
5.3
CVE-2026-12353
Rhcs: memory leak during https connection leads to denial of service