A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's ExternalProcessConstraint mechanism to execute arbitrary commands with attacker-controlled environment variables, achieving code execution as the pkiuser account.

oracle_linux ELSA-2026-73765: ELSA-2026-73765:  dogtag-pki security update (IMPORTANT)

oracle_linux ELSA-2026-73766: ELSA-2026-73766:  pki-core security update (IMPORTANT)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73765 advisory.

    IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure     deployments.  IdM PKI consists of the following components:
      * Certificate Authority (CA)
      * Key Recovery Authority (KRA)
      * Online Certificate Status Protocol (OCSP) Manager
      * Token Key Service (TKS)
      * Token Processing Service (TPS)
      * Automatic Certificate Management Environment (ACME) Responder
      * Enrollment over Secure Transport (EST) Responder

    Security Fix(es):

    * pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content     (ExternalProcessConstraint) (CVE-2026-76561)

    * pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the     admin-only raw profile creation endpoint (CVE-2026-80110)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73766 advisory.

    The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate     System.

    Security Fix(es):

    * pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content     (ExternalProcessConstraint) (CVE-2026-76561)

    * pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the     admin-only raw profile creation endpoint (CVE-2026-80110)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate     profile import functionality does not fully validate uploaded profile content beyond the profile ID. An     authenticated user with CA Administrator privileges can exploit Dogtag's ExternalProcessConstraint     mechanism to execute arbitrary commands with attacker-controlled environment variables, achieving code     execution as the pkiuser account. (CVE-2026-76561)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
351865	RHEL 10 : dogtag-pki (RHSA-2026:73765)	Nessus	Red Hat Local Security Checks	Local	high
351862	RHEL 9 : pki-core (RHSA-2026:73766)	Nessus	Red Hat Local Security Checks	Local	high
343834	Linux Distros Unpatched Vulnerability : CVE-2026-76561	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-76561

high

Tenable Plugins

Coming Soon

high

high

high