Red Hat Certificate System 9 vulnerabilities

9 CVEs affecting Red Hat Certificate System 9, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-104988, published 2026-10-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-18047, published 2026-07-28. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the…
CVE-2026-12353, published 2026-07-23. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint. Depending on how the RHCS server is…
CVE-2026-76561, published 2026-09-08. High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile…
CVE-2026-11873, published 2026-09-01. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated…
CVE-2026-17039, published 2026-07-24. Low severity, CVSS 3.1. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated…
CVE-2026-18369, published 2026-07-30. Medium severity, CVSS 5.8. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a…
CVE-2026-53682, published 2026-09-01. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security…
CVE-2026-104988, published 2026-10-02. High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client…
CVE-2026-80110, published 2026-09-21. High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity,…