Red Hat Certificate System 11 vulnerabilities

7 CVEs affecting Red Hat Certificate System 11, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-104988, published 2026-10-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-89059, published 2026-09-18. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote,…
CVE-2026-18047, published 2026-07-28. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the…
CVE-2026-17039, published 2026-07-24. Low severity, CVSS 3.1. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated…
CVE-2026-89058, published 2026-09-18. High severity, CVSS 7.4. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with…
CVE-2026-18369, published 2026-07-30. Medium severity, CVSS 5.8. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a…
CVE-2026-104988, published 2026-10-02. High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client…
CVE-2026-78323, published 2026-08-24. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without…