Quick answers
- Is CVE-2026-18922 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-18922 being exploited in the wild.
- How severe is CVE-2026-18922?
- Critical severity, with a CVSS score of 9.8, published 7 September 2026.
- Which products and versions are affected?
- 389 Directory Server prior to 1.3.11.1-15.el7_9.
- Is there a fix for CVE-2026-18922?
- A patch was published on 2026-09-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-18922 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-18922?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authentication bypass in 389 Directory Server's SASL PLAIN implementation. During SASL PLAIN authentication, a stale identity from a failed bind attempt (e.g., failed Directory Manager bind with incorrect password) is retained in a Cyrus SASL auxiliary property and can be incorrectly applied to a subsequent successful bind on the same connection, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with wrong credentials, then complete either a SASL ANONYMOUS bind or a valid low-privileged account's successful bind on the same connection, causing the server to incorrectly grant Directory Manager authority. The vulnerability is network-accessible and requires no authentication to initiate; a fix is available in 389-ds-base version 1.3.11.1-15.el7_9.
Affected products
- 389 Directory Server prior to 1.3.11.1-15.el7_9
Timeline
- 2026-09-07: disclosed
- 2026-09-08: patched