A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly     configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker     with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all     SSSD-enrolled hosts.(CVE-2026-14474)

    A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the     auth_token_length field against the remaining buffer size before processing. A local attacker can exploit     this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and     process crash, resulting in a denial of service.(CVE-2026-68743)

    A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates     reply space for all group entries but does not shrink the packet when groups are skipped, causing     uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose     cached directory data and heap layout information from the sssd_nss process.(CVE-2026-68744)

    A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function     does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO     management access to write files outside the GPO cache directory as root. On default RHEL configurations     with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication     bypass.(CVE-2026-14476)

    A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a     use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could     exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that     disrupts authentication. This vulnerability also presents a potential for privilege escalation, although     it is difficult to exploit.(CVE-2026-12610)

Tenable has extracted the preceding description block directly from the EulerOS sssd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function     does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO     management access to write files outside the GPO cache directory as root. On default RHEL configurations     with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication     bypass.(CVE-2026-14476)

    A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates     reply space for all group entries but does not shrink the packet when groups are skipped, causing     uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose     cached directory data and heap layout information from the sssd_nss process.(CVE-2026-68744)

    A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly     configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker     with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all     SSSD-enrolled hosts.(CVE-2026-14474)

    A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the     auth_token_length field against the remaining buffer size before processing. A local attacker can exploit     this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and     process crash, resulting in a denial of service.(CVE-2026-68743)

    A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a     use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could     exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that     disrupts authentication. This vulnerability also presents a potential for privilege escalation, although     it is difficult to exploit.(CVE-2026-12610)

Tenable has extracted the preceding description block directly from the EulerOS sssd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1787394686 advisory.

  - A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the     auth_token_length field against the remaining buffer size before processing. A local attacker can exploit     this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and     process crash, resulting in a denial of service. (CVE-2026-68743)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787314091 advisory.

  - A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the     auth_token_length field against the remaining buffer size before processing. A local attacker can exploit     this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and     process crash, resulting in a denial of service. (CVE-2026-68743)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788440142 advisory.

  - A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the     auth_token_length field against the remaining buffer size before processing. A local attacker can exploit     this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and     process crash, resulting in a denial of service. (CVE-2026-68743)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787314091 advisory.

  - A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the     auth_token_length field against the remaining buffer size before processing. A local attacker can exploit     this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and     process crash, resulting in a denial of service. (CVE-2026-68743)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1789479226 advisory.

  - A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the     auth_token_length field against the remaining buffer size before processing. A local attacker can exploit     this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and     process crash, resulting in a denial of service. (CVE-2026-68743)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109823 advisory.

    A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the     auth_token_length field against the remaining buffer size before processing. A local attacker can exploit     this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and     process crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8718-1 advisory.

    It was discovered that SSSD did not properly validate authentication token lengths when processing PAM     responder requests. A local attacker could possibly use this issue to cause SSSD to crash, resulting in a     denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21748-1 advisory.

    Security issues fixed:

    - CVE-2026-68742: insufficient validation in the NSS responder can lead to an out-of-bounds read and a     process crash       when a crafted GETHOSTBYADDR request is sent to the NSS responder socket (bsc#1273922).
    - CVE-2026-68743: insufficient validation in the PAM responder can lead to an out-of-bounds read and a     process crash       when a crafted protocol v1 request is processed (bsc#1273925).
    - CVE-2026-68744: improper memory management in the NSS responder can lead to uninitialized heap memory     disclosure       from the `sssd_nss` process (bsc#1273924).

    Other updates and bugfixes:

    - Add `systemd-tmpfiles` configuration file to populate `/var/lib/sss` with the correct permissions on     transactional       servers (bsc#1274748).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3797-1 advisory.

    This update for sssd fixes the following issue:

    - CVE-2026-68743: insufficient validation in the PAM responder can lead to an out-of-bounds read and a     process crash       when a crafted protocol v1 request is processed (bsc#1273925).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the     auth_token_length field against the remaining buffer size before processing. A local attacker can exploit     this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and     process crash, resulting in a denial of service. (CVE-2026-68743)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
364974	EulerOS 2.0 SP11 : sssd (EulerOS-SA-2026-4382)	Nessus	Huawei Local Security Checks	Local	high
364951	EulerOS 2.0 SP13 : sssd (EulerOS-SA-2026-4201)	Nessus	Huawei Local Security Checks	Local	high
364877	EulerOS 2.0 SP13 : sssd (EulerOS-SA-2026-4110)	Nessus	Huawei Local Security Checks	Local	high
364803	EulerOS 2.0 SP11 : sssd (EulerOS-SA-2026-4292)	Nessus	Huawei Local Security Checks	Local	high
360618	CentOS Linux 7 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc (CENTOS7:CLSA-2026:1787394686)	Nessus	CentOS Local Security Checks	Local	high
360371	AlmaLinux 9.6 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc (ALMALINUX9.6:CLSA-2026:1787314091)	Nessus	Alma Linux Local Security Checks	Local	high
360021	AlmaLinux 9.2 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc (ALMALINUX9.2:CLSA-2026:1788440142)	Nessus	Alma Linux Local Security Checks	Local	high
359913	Rocky Linux 9.6 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc (ALMALINUX9.6:CLSA-2026:1787314091)	Nessus	Rocky Linux Local Security Checks	Local	high
352046	CentOS Linux 6 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_idmap / libsss_idmap-devel / etc (CENTOS6:CLSA-2026:1789479226)	Nessus	CentOS Local Security Checks	Local	high
347042	Unity Linux 20.1070-8ae / 20.1070e Security Update: sssd (UTSA-2026-109823)	Nessus	Unity Linux Local Security Checks	Local	high
344617	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : SSSD vulnerability (USN-8718-1)	Nessus	Ubuntu Local Security Checks	Local	high
343953	openSUSE 16: libipa_hbac-devel / libipa_hbac0 / libnfsidmap-sss / etc (openSUSE-SU-2026:21748-1)	Nessus	SuSE Local Security Checks	Local	high
341026	SUSE SLES12: libipa_hbac-devel / libipa_hbac0 / libsss_certmap0 / etc (SUSE-SU-2026:3797-1)	Nessus	SuSE Local Security Checks	Local	high
332086	Linux Distros Unpatched Vulnerability : CVE-2026-68743	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-68743

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high