# CVE-2026-18922: 389 Directory Server SASL PLAIN authentication privilege escalation

Source: https://junglewise.ai/threats/cve-2026-18922-389-directory-server-sasl-plain-authentication-privilege  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-18922 · Severity: critical · CVSS 9.8 · Published 2026-09-07

389 Directory Server is an LDAP directory service used to store and manage user identity and access information across enterprise networks. A flaw in SASL authentication allows attackers to escalate privileges to the Directory Manager (root-level access) by exploiting stale authentication state from failed login attempts. An attacker can complete a low-privilege or anonymous login after a failed high-privilege attempt, gaining full administrative control over the directory and all user data without valid credentials.

## Quick answers

**Is CVE-2026-18922 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18922 being exploited in the wild.

**How severe is CVE-2026-18922?** Critical severity, with a CVSS score of 9.8, published 7 September 2026.

**Which products and versions are affected?** 389 Directory Server prior to 1.3.11.1-15.el7_9.

**Is there a fix for CVE-2026-18922?** A patch was published on 2026-09-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18922 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-18922?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass in 389 Directory Server's SASL PLAIN implementation. During SASL PLAIN authentication, a stale identity from a failed bind attempt (e.g., failed Directory Manager bind with incorrect password) is retained in a Cyrus SASL auxiliary property and can be incorrectly applied to a subsequent successful bind on the same connection, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with wrong credentials, then complete either a SASL ANONYMOUS bind or a valid low-privileged account's successful bind on the same connection, causing the server to incorrectly grant Directory Manager authority. The vulnerability is network-accessible and requires no authentication to initiate; a fix is available in 389-ds-base version 1.3.11.1-15.el7_9.

## Affected products

- 389 Directory Server prior to 1.3.11.1-15.el7_9

## Timeline

- 2026-09-07: disclosed
- 2026-09-08: patched

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/errata/RHSA-2026:64771](https://access.redhat.com/errata/RHSA-2026:64771)