A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential, FreeIPA still does not validate the root@REALM canonical name, which can also be used as the realm administrator's name. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:17084 advisory.

    * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0162 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-7493:
    A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is     similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the     previously released version added validations for the admin@REALM credential, FreeIPA still does not     validate the root@REALM canonical name, which can also be used as the realm administrator's name. This     flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive     data and sensitive data exfiltration.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:17084 advisory.

    * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:17646 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:17649 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:17645 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:17647 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:17648 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3026 advisory.

    A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is     similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the     previously released version added validations for the admin@REALM credential, FreeIPA still does not     validate the root@REALM canonical name, which can also be used as the realm administrator's name. This     flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive     data and sensitive data exfiltration. (CVE-2025-7493)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3025 advisory.

    A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is     similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the     previously released version added validations for the admin@REALM credential, FreeIPA still does not     validate the root@REALM canonical name, which can also be used as the realm administrator's name. This     flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive     data and sensitive data exfiltration. (CVE-2025-7493)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:17085 advisory.

    * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:17129 advisory.

    * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-1a3968c333 advisory.

    - CVE-2025-7493: host to admin escalation prevention: https://www.freeipa.org/release-notes/4-12-5.html

    - Update FreeIPA to latest fixes from ipa-4-12 branch




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-17085 advisory.

    [4.12.2-15.0.1.el10_0.4]
    - Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674]
    - Add bind to ipa-server-common Requires [Orabug: 36518596]

    [4.12.2-15.el10_0.4]
    - Resolves: RHEL-113245       EMBARGOED CVE-2025-7493 ipa: Privilege escalation from host to domain admin in FreeIPA

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-54a485ee85 advisory.

    - CVE-2025-7493: host to admin escalation prevention: https://www.freeipa.org/release-notes/4-12-5.html

    - Rebuild for Python 3.14.0rc3

    - Update FreeIPA to latest fixes from ipa-4-12 branch




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-e41ba62ff1 advisory.

    - CVE-2025-7493: host to admin escalation prevention: https://www.freeipa.org/release-notes/4-12-5.html

    - Update FreeIPA to latest fixes from ipa-4-12 branch



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-17129 advisory.

    bind-dyndb-ldap     [11.6-6]
    - Fix rpminspect warnings       Resolves: RHEL-22497

    custodia     ipa     [4.9.13-20.0.1]
    - Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674]

    [4.9.13-20]
    - Refactor ipatests for unique krbcanonicalname       Resolves: RHEL-110061

    [4.9.13-19]
    - Enforce uniqueness across krbprincipalname and krbcanonicalname       ipa-kdb: enforce PAC presence on TGT for TGS-REQ       ipatests: extend test for unique krbcanonicalname       Resolves: RHEL-110061

    ipa-healthcheck     opendnssec     [2.1.7-2]
    - Don't creat /var/run/opendnssec directory
    - Resolves: RHEL-12163

    python-jwcrypto     python-kdcproxy     [0.4-5.1]
    - Log KDC timeout only once per request       Resolves: RHEL-68634

    python-qrcode     python-yubico     pyusb     slapi-nis     softhsm

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-17084 advisory.

    - Resolves: RHEL-110068       EMBARGOED CVE-2025-7493 ipa: Privilege escalation from host to domain admin in FreeIPA

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is     similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the     previously released version added validations for the admin@REALM credential, FreeIPA still does not     validate the root@REALM canonical name, which can also be used as the realm administrator's name. This     flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive     data and sensitive data exfiltration. (CVE-2025-7493)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:17087 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:17084 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:17129 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:17085 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:17088 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:17086 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
271210	AlmaLinux 9 : ipa (ALSA-2025:17084)	Nessus	Alma Linux Local Security Checks	critical
270629	Alibaba Cloud Linux 3 : 0162: idm:DL1 (ALINUX3-SA-2025:0162)	Nessus	Alibaba Cloud Linux Local Security Checks	critical
269989	RockyLinux 9 : ipa (RLSA-2025:17084)	Nessus	Rocky Linux Local Security Checks	critical
269950	RHEL 8 : idm:client (RHSA-2025:17646)	Nessus	Red Hat Local Security Checks	critical
269949	RHEL 7 : ipa (RHSA-2025:17649)	Nessus	Red Hat Local Security Checks	critical
269946	RHEL 8 : idm:client (RHSA-2025:17645)	Nessus	Red Hat Local Security Checks	critical
269906	RHEL 8 : idm:DL1 (RHSA-2025:17647)	Nessus	Red Hat Local Security Checks	critical
269905	RHEL 8 : idm:DL1 (RHSA-2025:17648)	Nessus	Red Hat Local Security Checks	critical
269247	Amazon Linux 2 : ipa, --advisory ALAS2-2025-3026 (ALAS-2025-3026)	Nessus	Amazon Linux Local Security Checks	critical
269246	Amazon Linux 2 : 389-ds-base, --advisory ALAS2-2025-3025 (ALAS-2025-3025)	Nessus	Amazon Linux Local Security Checks	critical
269231	RockyLinux 10 : ipa (RLSA-2025:17085)	Nessus	Rocky Linux Local Security Checks	critical
266465	AlmaLinux 8 : idm:DL1 (ALSA-2025:17129)	Nessus	Alma Linux Local Security Checks	critical
266432	Fedora 41 : freeipa (2025-1a3968c333)	Nessus	Fedora Local Security Checks	critical
266431	Oracle Linux 10 : ipa (ELSA-2025-17085)	Nessus	Oracle Linux Local Security Checks	critical
266429	Fedora 43 : freeipa (2025-54a485ee85)	Nessus	Fedora Local Security Checks	critical
266423	Fedora 42 : freeipa (2025-e41ba62ff1)	Nessus	Fedora Local Security Checks	critical
266385	Oracle Linux 8 : idm:DL1 (ELSA-2025-17129)	Nessus	Oracle Linux Local Security Checks	critical
266355	Oracle Linux 9 : ipa (ELSA-2025-17084)	Nessus	Oracle Linux Local Security Checks	critical
266350	Linux Distros Unpatched Vulnerability : CVE-2025-7493	Nessus	Misc.	critical
266329	RHEL 9 : ipa (RHSA-2025:17087)	Nessus	Red Hat Local Security Checks	critical
266327	RHEL 9 : ipa (RHSA-2025:17084)	Nessus	Red Hat Local Security Checks	critical
266323	RHEL 8 : idm:DL1 (RHSA-2025:17129)	Nessus	Red Hat Local Security Checks	critical
266302	RHEL 10 : ipa (RHSA-2025:17085)	Nessus	Red Hat Local Security Checks	critical
266300	RHEL 9 : ipa (RHSA-2025:17088)	Nessus	Red Hat Local Security Checks	critical
266299	RHEL 9 : ipa (RHSA-2025:17086)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2025-7493

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical