A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_73766 advisory.

    * pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content     (ExternalProcessConstraint) (CVE-2026-76561)

    * pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the     admin-only raw profile creation endpoint (CVE-2026-80110)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_73765 advisory.

    * pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content     (ExternalProcessConstraint) (CVE-2026-76561)

    * pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the     admin-only raw profile creation endpoint (CVE-2026-80110)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1951:02 advisory.

    * pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content     (ExternalProcessConstraint) (CVE-2026-76561)
      * pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the     admin-only raw profile creation endpoint (CVE-2026-80110)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:73765 advisory.

    * pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content     (ExternalProcessConstraint) (CVE-2026-76561)
      * pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the     admin-only raw profile creation endpoint (CVE-2026-80110)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:73766 advisory.

    * pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content     (ExternalProcessConstraint) (CVE-2026-76561)
      * pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the     admin-only raw profile creation endpoint (CVE-2026-80110)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:73766 advisory.

    * pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content     (ExternalProcessConstraint) (CVE-2026-76561)

    * pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the     admin-only raw profile creation endpoint (CVE-2026-80110)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:73765 advisory.

    * pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content     (ExternalProcessConstraint) (CVE-2026-76561)

    * pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the     admin-only raw profile creation endpoint (CVE-2026-80110)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-73766 advisory.

    - RHEL-245465 CVE-2026-76561 pki-core: ExternalProcessConstraint executable allow-list

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-73765 advisory.

    - RHEL-245469 CVE-2026-76561 dogtag-pki: ExternalProcessConstraint executable allow-list

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73765 advisory.

    IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure     deployments.  IdM PKI consists of the following components:
      * Certificate Authority (CA)
      * Key Recovery Authority (KRA)
      * Online Certificate Status Protocol (OCSP) Manager
      * Token Key Service (TKS)
      * Token Processing Service (TPS)
      * Automatic Certificate Management Environment (ACME) Responder
      * Enrollment over Secure Transport (EST) Responder

    Security Fix(es):

    * pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content     (ExternalProcessConstraint) (CVE-2026-76561)

    * pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the     admin-only raw profile creation endpoint (CVE-2026-80110)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73766 advisory.

    The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate     System.

    Security Fix(es):

    * pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content     (ExternalProcessConstraint) (CVE-2026-76561)

    * pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the     admin-only raw profile creation endpoint (CVE-2026-80110)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding     literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a     wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the     CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require     Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged     profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from     this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.
    (CVE-2026-80110)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
362641	Rocky Linux 9 [CIQ] Security Update: idm-pki-acme / idm-pki-base / idm-pki-ca / idm-pki-java / etc Multiple Vulnerabilities (crlsa-2026_73766)	Nessus	Rocky Linux Local Security Checks	Local	high
362639	Rocky Linux 10.2 [CIQ] Security Update: dogtag-pki-debugsource / idm-pki-acme / idm-pki-base / idm-pki-ca / etc Multiple Vulnerabilities (crlsa-2026_73765)	Nessus	Rocky Linux Local Security Checks	Local	high
362587	MiracleLinux 9 : pki-core-11.7.1-2.el9_8 (AXSA:2026-1951:02)	Nessus	Miracle Linux Local Security Checks	Local	high
362404	AlmaLinux 10 : dogtag-pki (ALSA-2026:73765)	Nessus	Alma Linux Local Security Checks	Local	high
362398	AlmaLinux 9 : pki-core (ALSA-2026:73766)	Nessus	Alma Linux Local Security Checks	Local	high
359466	RockyLinux 9 : pki-core (RLSA-2026:73766)	Nessus	Rocky Linux Local Security Checks	Local	high
359463	RockyLinux 10 : dogtag-pki (RLSA-2026:73765)	Nessus	Rocky Linux Local Security Checks	Local	high
353281	Oracle Linux 9 : pki-core (ELSA-2026-73766)	Nessus	Oracle Linux Local Security Checks	Local	high
353278	Oracle Linux 10 : dogtag-pki (ELSA-2026-73765)	Nessus	Oracle Linux Local Security Checks	Local	high
351865	RHEL 10 : dogtag-pki (RHSA-2026:73765)	Nessus	Red Hat Local Security Checks	Local	high
351862	RHEL 9 : pki-core (RHSA-2026:73766)	Nessus	Red Hat Local Security Checks	Local	high
348662	Linux Distros Unpatched Vulnerability : CVE-2026-80110	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-80110

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high