Is CVE-2026-11861 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11861 being exploited in the wild.

How severe is CVE-2026-11861?

Critical severity, with a CVSS score of 9.6, published 20 August 2026.

Which products and versions are affected?

Red Hat Enterprise Linux 9 all.

Is there a fix for CVE-2026-11861?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11861 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-11861?

Check whether you run Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11861: FreeIPA TGS impersonation authentication bypass in trust relationships

CVE-2026-11861 · Severity: critical · CVSS 9.6 · Published 2026-08-20

FreeIPA is an open-source identity management platform widely deployed in enterprises to manage user authentication, authorization, and access control. When FreeIPA is configured to trust Active Directory domains, an authenticated Active Directory user can bypass authentication checks and impersonate any FreeIPA service user. This vulnerability bypasses the normal security protections that FreeIPA uses to verify service requests, allowing attackers to escalate privileges and gain unauthorized access to protected resources including portals, file servers, and LDAP directories.

Technologies: Red Hat Enterprise Linux 9. Vendors: Red Hat.

Quick answers

Is CVE-2026-11861 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11861 being exploited in the wild.
How severe is CVE-2026-11861?: Critical severity, with a CVSS score of 9.6, published 20 August 2026.
Which products and versions are affected?: Red Hat Enterprise Linux 9 all.
Is there a fix for CVE-2026-11861?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11861 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-11861?: Check whether you run Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Kerberos Ticket Granting Service (TGS) impersonation flaw in FreeIPA's handling of cross-realm trust relationships with Active Directory. When an Active Directory user requests a TGS ticket for a FreeIPA service, FreeIPA fails to validate the Privilege Attribute Certificate (PAC) contained within the ticket, allowing an attacker to forge or manipulate the client name (cname) field. An authenticated Active Directory user can exploit this by crafting a malicious TGS request to impersonate legitimate FreeIPA service users, bypassing authentication checks for the portal, SMB server, LDAP directory, and other services. The vulnerability requires the attacker to be authenticated to Active Directory and for a trust relationship to be configured between FreeIPA and AD; no additional user interaction is required. Patches are available via Red Hat advisory RHSA-2026:70564.

Affected products

Red Hat FreeIPA <UNKNOWN>
Red Hat Red Hat Enterprise Linux 9 all

Timeline

2026-08-20: disclosed
2026-09-23: advisory: Red Hat advisory RHSA-2026:70564 issued

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.