Is CVE-2026-14969 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14969 being exploited in the wild.

How severe is CVE-2026-14969?

Medium severity, with a CVSS score of 4.4, published 7 July 2026.

Which products and versions are affected?

Red Hat 389-Ds-Base Red Hat Directory Server 11, 12, 13; RHEL 7, 8, 9, 10.

Is there a fix for CVE-2026-14969?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-14969 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-14969?

Check whether you run Red Hat 389-Ds-Base at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14969: Red Hat 389-ds-base Predictable IV in LDBM Attribute Encryption

CVE-2026-14969 · Severity: medium · CVSS 4.4 · Published 2026-07-07

A security flaw was identified in the 389 Directory Server, an enterprise-grade LDAP server used for managing user identities and authentication. The software uses a predictable method for encrypting sensitive data stored in its database, which could allow an administrator or an attacker with high-level access to the server's files to identify matching pieces of encrypted information. This could lead to the exposure of sensitive user attributes or facilitate further decryption of protected data.

Technologies: Red Hat 389-Ds-Base. Vendors: Red Hat.

Quick answers

Is CVE-2026-14969 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14969 being exploited in the wild.
How severe is CVE-2026-14969?: Medium severity, with a CVSS score of 4.4, published 7 July 2026.
Which products and versions are affected?: Red Hat 389-Ds-Base Red Hat Directory Server 11, 12, 13; RHEL 7, 8, 9, 10.
Is there a fix for CVE-2026-14969?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14969 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-14969?: Check whether you run Red Hat 389-Ds-Base at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the LDBM backend of 389-ds-base (specifically in ldbm_attrcrypt.c) due to the use of a hardcoded, static initialization vector (IV) consisting of 16 bytes of 0x61 for AES-CBC and 3DES-CBC encryption operations. Because CBC mode requires a unique and unpredictable IV for each operation to ensure semantic security, this implementation flaw results in identical plaintext attributes producing identical ciphertext. An attacker with privileged local access to the LDBM database files can exploit this to detect plaintext equality across encrypted entries and perform offline cryptanalysis. The vulnerability is tracked as CWE-329.

Affected products

Red Hat 389-ds-base Red Hat Directory Server 11, 12, 13; RHEL 7, 8, 9, 10

Timeline

2026-07-07: disclosed: Initial vulnerability report and CVE assignment
2026-07-07: advisory: NVD and Red Hat published advisory details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.