CVE-2025-4404: Red Hat Enterprise Linux 10

Critical severity, CVSS 9.1. EPSS: 2% chance of exploitation in the next 30 days.

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.

Affected products

Red Hat Red Hat Enterprise Linux 10: before 0:4.12.2-15.el10_0.1 (fixed in 0:4.12.2-15.el10_0.1)
Red Hat Red Hat Enterprise Linux 6
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support: before 0:4.6.8-5.el7_9.18 (fixed in 0:4.6.8-5.el7_9.18)
Red Hat Red Hat Enterprise Linux 8: before 8100020250603150652.143e9e98 (fixed in 8100020250603150652.143e9e98); before 8100020250603134209.823393f5 (fixed in 8100020250603134209.823393f5)
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support: before 8020020250609031831.50ea30f9 (fixed in 8020020250609031831.50ea30f9); before 8020020250609030144.792f4060 (fixed in 8020020250609030144.792f4060)
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: before 8040020250609101903.f153676a (fixed in 8040020250609101903.f153676a); before 8040020250609095221.5b01ab7e (fixed in 8040020250609095221.5b01ab7e)
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: before 8060020250606060927.c1533a64 (fixed in 8060020250606060927.c1533a64); before 8060020250606060504.ada582f1 (fixed in 8060020250606060504.ada582f1)
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service: before 8060020250606060927.c1533a64 (fixed in 8060020250606060927.c1533a64); before 8060020250606060504.ada582f1 (fixed in 8060020250606060504.ada582f1)
Red Hat Red Hat Enterprise Linux 8.6 Update Services For SAP Solutions: before 8060020250606060927.c1533a64 (fixed in 8060020250606060927.c1533a64); before 8060020250606060504.ada582f1 (fixed in 8060020250606060504.ada582f1)
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service: before 8080020250604195510.e581a9e4 (fixed in 8080020250604195510.e581a9e4); before 8080020250604202433.b0a6ceea (fixed in 8080020250604202433.b0a6ceea)
Red Hat Red Hat Enterprise Linux 8.8 Update Services For SAP Solutions: before 8080020250604195510.e581a9e4 (fixed in 8080020250604195510.e581a9e4); before 8080020250604202433.b0a6ceea (fixed in 8080020250604202433.b0a6ceea)
Red Hat Red Hat Enterprise Linux 9: before 0:4.12.2-14.el9_6.1 (fixed in 0:4.12.2-14.el9_6.1)
Red Hat Red Hat Enterprise Linux 9.0 Update Services For SAP Solutions: before 0:4.9.8-11.el9_0.4 (fixed in 0:4.9.8-11.el9_0.4)
Red Hat Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions: before 0:4.10.1-12.el9_2.4 (fixed in 0:4.10.1-12.el9_2.4)
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support: before 0:4.11.0-15.el9_4.5 (fixed in 0:4.11.0-15.el9_4.5)

Published 2025-06-17. Last modified 2026-06-30.