A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-9189 advisory.

    [4.6.8-5.0.3.el7_9.17]
    - Fix privilege escalation from host to domain vulnerability
    - CVE-2025-4404 [Orabug: 38085890]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:9188 advisory.

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:9184 advisory.

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-9190 advisory.

    - Resolves: RHEL-89908       EMBARGOED CVE-2025-4404 ipa: Privilege escalation from host to domain admin in FreeIPA

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2901 advisory.

    A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA     package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default,     allowing users to create services with the same canonical name as the REALM admin. When a successful     attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the     admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM,     leading to access to sensitive data and sensitive data exfiltration. (CVE-2025-4404)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-9188 advisory.

    bind-dyndb-ldap     [11.6-6]
    - Fix rpminspect warnings       Resolves: RHEL-22497

    custodia     ipa     [4.9.13-18.0.1]
    - Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674]

    [4.9.13-18]
    - Set krbCanonicalName admin@REALM on the admin user       Resolves: RHEL-89895

    [4.9.13-17]
    - kdb: keeep ipadb_get_connection() from succeding with null LDAP context       Resolves: RHEL-58453

    ipa-healthcheck     opendnssec     [2.1.7-2]
    - Don't creat /var/run/opendnssec directory
    - Resolves: RHEL-12163

    python-jwcrypto     python-kdcproxy     [0.4-5.1]
    - Log KDC timeout only once per request       Resolves: RHEL-68634

    python-qrcode     python-yubico     pyusb     slapi-nis     softhsm

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-9184 advisory.

    - Resolves: RHEL-89908       EMBARGOED CVE-2025-4404 ipa: Privilege escalation from host to domain admin in FreeIPA

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9185 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9186 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9184 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9191 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9192 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9190 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9187 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9189 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9194 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9188 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9193 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
241497	Oracle Linux 7 : ipa (ELSA-2025-9189)	Nessus	Oracle Linux Local Security Checks	critical
240953	AlmaLinux 8 : idm:DL1 (ALSA-2025:9188)	Nessus	Alma Linux Local Security Checks	critical
240934	AlmaLinux 9 : ipa (ALSA-2025:9184)	Nessus	Alma Linux Local Security Checks	critical
240881	Oracle Linux 10 : ipa (ELSA-2025-9190)	Nessus	Oracle Linux Local Security Checks	critical
240456	Amazon Linux 2 : ipa (ALAS-2025-2901)	Nessus	Amazon Linux Local Security Checks	critical
240183	Oracle Linux 8 : idm:DL1 (ELSA-2025-9188)	Nessus	Oracle Linux Local Security Checks	critical
240173	Oracle Linux 9 : ipa (ELSA-2025-9184)	Nessus	Oracle Linux Local Security Checks	critical
240142	RHEL 9 : ipa (RHSA-2025:9185)	Nessus	Red Hat Local Security Checks	critical
240139	RHEL 9 : ipa (RHSA-2025:9186)	Nessus	Red Hat Local Security Checks	critical
240138	RHEL 9 : ipa (RHSA-2025:9184)	Nessus	Red Hat Local Security Checks	critical
240136	RHEL 8 : idm:DL1 (RHSA-2025:9191)	Nessus	Red Hat Local Security Checks	critical
240135	RHEL 8 : idm:DL1 (RHSA-2025:9192)	Nessus	Red Hat Local Security Checks	critical
240134	RHEL 10 : ipa (RHSA-2025:9190)	Nessus	Red Hat Local Security Checks	critical
240133	RHEL 9 : ipa (RHSA-2025:9187)	Nessus	Red Hat Local Security Checks	critical
240132	RHEL 7 : ipa (RHSA-2025:9189)	Nessus	Red Hat Local Security Checks	critical
240130	RHEL 8 : idm:DL1 (RHSA-2025:9194)	Nessus	Red Hat Local Security Checks	critical
240127	RHEL 8 : idm:DL1 (RHSA-2025:9188)	Nessus	Red Hat Local Security Checks	critical
240126	RHEL 8 : idm:client (RHSA-2025:9193)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2025-4404

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical