Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - 在 SSSD 中發現缺陷。當設定為在 LDAP （輕量型目錄存取通訊協定） 環境中的限制性存取規則之前評估密碼到期警告時，密碼到期警告會提前終止規則評估，並將存取要求視為成功。使用替代身份驗證方法 （例如 SSH 公開金鑰身份驗證） 的密碼過期的遠端身份驗證使用者可以利用此缺陷來繞過存取控制限制並獲得對受保護系統未經授權的存取。（CVE-2026-92821）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 SSSD 中发现一个缺陷。当配置为在 LDAP（轻型目录访问协议）环境中的限制访问规则之前评估密码过期警告时，过期密码警告会提早终止规则评估并将访问请求视为成功。使用替代认证方法（例如 SSH 公钥认证）且密码过期的经认证远程用户可利用此缺陷，绕过访问控制限制并获得对受保护系统的未经授权的访问权限。（CVE-2026-92821）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - SSSD に欠陥が見つかりました。LDAP (Lightweight Directory Access Protocol) 環境の制限付きアクセスルールの前にパスワードの有効期限の警告を評価するように設定されている場合、パスワードの有効期限が切れた場合、パスワードの警告がルールの評価を早期に終了し、アクセスリクエストを成功したものとして処理します。SSH公開鍵認証などの代替認証方法を使用するパスワードの有効期限が切れたリモートの認証されたユーザーは、この欠陥を悪用してアクセスコントロール制限をバイパスし、保護されたシステムへの認証されていないアクセスを取得する可能性があります。(CVE-2026-92821)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive     access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning     terminates rule evaluation early and treats the access request as successful. A remote authenticated user     with an expired password using an alternative authentication method, such as SSH public key     authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access     to protected systems. (CVE-2026-92821)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3416 advisory.

    A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted     request to the autofs responder UNIX socket. Due to improper buffer offset calculation during request     parsing, the service performs an out-of-bounds memory read. This flaw can cause the autofs responder     process to crash, resulting in a denial of service (DoS). (CVE-2026-104029)

    A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory     allocated during successful request processing is not released until the client connection terminates. A     local attacker can exploit this vulnerability by maintaining an open connection and repeatedly submitting     valid requests, leading to memory exhaustion and a Denial of Service (DoS). (CVE-2026-104031)

    A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates     through the autofs responder due to missing authorization checks. This triggers global cache invalidation     and forces repeated lookups to backend directory providers, leading to a Denial of Service (DoS) from     degraded automount availability and elevated resource consumption. (CVE-2026-104032)

    A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory     Access Protocol) shadow attributes, SSSD fails to treat an expiration value of zero as an expired account.
    A user with valid credentials for an expired account can exploit this flaw to bypass access controls and     authenticate to the system. This allows unauthorized access to persist after the account was intended to     be deactivated. (CVE-2026-104033)

    A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM)     responder during Kerberos ticket-granting ticket (TGT) renewal, where a deferred callback accesses memory     that has already been released. An authenticated local user with a renewable Kerberos ticket can trigger     this issue on systems configured with KCM renewal, causing the KCM responder service to crash and     resulting in a Denial of Service (DoS). (CVE-2026-104034)

    A flaw was found in SSSD. An issue in the Kerberos Credential Manager (KCM) responder allows a local user     to cause a Denial of Service (DoS) by maintaining a persistent connection and repeatedly storing and     destroying credentials. Because the service fails to release cached objects from memory when credentials     are removed, memory consumption grows continuously, ultimately exhausting available memory and rendering     the service unresponsive. (CVE-2026-104035)

    A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin     detects if an entry exceeds the destination buffer size but fails to abort before copying data. A local     attacker can trigger this vulnerability by requesting identity lookups that resolve to oversized cached     entries, resulting in an out-of-bounds write. This flaw primarily leads to a Denial of Service (DoS) by     crashing the identity mapping service, and may also corrupt adjacent process memory. (CVE-2026-104036)

    A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request     with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an     out-of-bounds memory read, which can crash the responder process and result in a denial of service (DoS).
    (CVE-2026-104037)

    A flaw was found in sssd. A remote attacker can cause a denial of service (DoS) by submitting a     certificate that lacks an expected Security Identifier (SID) extension. In deployments configured with     SID-based certificate mapping rules, the service fails to verify the presence of the extension before     processing it, causing the process to crash during authentication or lookup operations. (CVE-2026-104038)

    A flaw was found in SSSD. A local user can cause a denial of service (DoS) by disrupting system     authentication services. When handling Generic Security Services Application Programming Interface     (GSSAPI) authentication in the Pluggable Authentication Module (PAM) responder, cached connection state is     freed upon completion without clearing the reference pointer. An attacker can exploit this by sending an     additional request over the same connection, causing the service to access invalid memory and unexpectedly     terminate. (CVE-2026-104039)

    A flaw was found in sssd. A local attacker can cause a Denial of Service (DoS) by sending a crafted     Pluggable Authentication Module (PAM) request containing a zero-length authentication token to the     responder socket. Due to missing input validation, the service attempts to read beyond buffer boundaries     when processing the token, causing the PAM responder to crash. (CVE-2026-104042)

    A flaw was found in SSSD. A local attacker with access to the Name Service Switch (NSS) responder UNIX     socket can trigger an integer underflow by sending a specially crafted request with an undersized packet     header. This issue causes an out-of-bounds memory read during packet parsing, crashing the responder     process and resulting in a Denial of Service (DoS). (CVE-2026-104043)

    A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race     condition in the autofs responder between asynchronous enumeration completion and map invalidation. By     repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause memory to     leak, leading to excessive memory consumption that can disrupt or crash the autofs service.
    (CVE-2026-104045)

    A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based     Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An     authenticated user in a trusted domain who shares the same username as an authorized local account can     bypass access policies and gain unauthorized access to protected services or hosts. (CVE-2026-104048)

    A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not     validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a     crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process     crash, resulting in a denial of service. (CVE-2026-68742)

    A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the     auth_token_length field against the remaining buffer size before processing. A local attacker can exploit     this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and     process crash, resulting in a denial of service. (CVE-2026-68743)

    A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates     reply space for all group entries but does not shrink the packet when groups are skipped, causing     uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose     cached directory data and heap layout information from the sssd_nss process. (CVE-2026-68744)

    A flaw was found in `sssd-kcm`. A local user or process able to connect to the `sssd-kcm` UNIX socket can     exploit this vulnerability. By sending a large request length header and then stalling the connection, an     attacker can cause the system to preallocate significant memory. This leads to memory exhaustion within     the `sssd-kcm` responder, resulting in a Denial of Service (DoS) for affected deployments.
    (CVE-2026-80048)

    A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder     service's available file descriptors (system handles used for open connections). By opening and     maintaining many concurrent connections to a responder socket while continuing to queue new connection     attempts, an attacker can trigger an unthrottled retry loop. This condition leads to high CPU utilization     and stalls the service, preventing legitimate identity and authentication requests from being processed.
    (CVE-2026-88252)

    A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including     `ppolicy` or `lockout`, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup     returns zero results. This can incorrectly return success and cache an allow decision, permitting     continued authorization for a deleted or deprovisioned user. A remote attacker with prior valid account     context could exploit this to maintain access to information and potentially make limited modifications to     resources that should no longer be available. (CVE-2026-90462)

    A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker,     by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-     of-bounds read. This out-of-bounds read may lead to a denial of service (DoS) by crashing the NSS     responder process. While unprivileged local clients can typically reach the socket, there is no evidence     of privilege escalation or reliable data disclosure. (CVE-2026-90463)

    A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's     protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can     exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can     trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a     local denial of service. (CVE-2026-90994)

    A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to     the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request.
    If the `pam_app_services` configuration is enabled and the service item is omitted from the request, a     NULL pointer dereference can occur. This vulnerability leads to a denial of service, causing the PAM     responder to crash and disrupt authentication services. (CVE-2026-90995)

    A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-     length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service     condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the     availability of the system responder. (CVE-2026-90996)

    A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive     access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning     terminates rule evaluation early and treats the access request as successful. A remote authenticated user     with an expired password using an alternative authentication method, such as SSH public key     authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access     to protected systems. (CVE-2026-92821)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5079-1 advisory.

    - CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running     can lead to a       use-after-free (bsc#1269807).
    - CVE-2026-68742: unvalidated address lengths in NSS responder packet parsing can cause a heap out-of-     bounds read       (bsc#1273922).
    - CVE-2026-68743: oversized length parameters in authentication requests can cause heap out-of-bounds     reads       (bsc#1273925).
    - CVE-2026-68744: unshrunk packet allocations during group resolution can allow uninitialized heap memory     disclosure       (bsc#1273924).
    - CVE-2026-90462: Fail-open in LDAP ppolicy access check allows continued authorization (bsc#1282584).
    - CVE-2026-90463: out-of-bounds read in the NSS service request parsers (bsc#1280360).
    - CVE-2026-90994: out-of-bounds read in PAM v1 parser (bsc#1280361).
    - CVE-2026-90995: NULL pointer dereference in PAM responder (bsc#1280362).
    - CVE-2026-90996: zero-length request body underflow in the NSS responder (bsc#1280363).
    - CVE-2026-92821: access control bypass due to premature LDAP access rule evaluation (bsc#1284326).
    - CVE-2026-104029: denial of service due to out-of-bounds read in autofs responder (bsc#1284314).
    - CVE-2026-104031: denial of service via memory exhaustion in autofs responder (bsc#1284316).
    - CVE-2026-104033: access control bypass due to improper LDAP shadow expiration check (bsc#1284318).
    - CVE-2026-104036: denial of service due to out-of-bounds write in NFS idmap plugin (bsc#1284321).
    - CVE-2026-104037: denial of service due to packet length underflow in autofs responder (bsc#1284322).
    - CVE-2026-104038: denial of service via missing SID extension in certificate mapping (bsc#1284323).
    - CVE-2026-104039: denial of service due to stale connection state reuse in PAM GSSAPI responder     (bsc#1284324).
    - CVE-2026-104043: Denial of Service via undersized packet parsing in NSS responder (bsc#1284266).
    - CVE-2026-104045: denial of service via race condition in autofs responder (bsc#1284470).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
363042	Linux Distros 未修補弱點：CVE-2026-92821	Nessus	Misc.	10/6/2026	11/7/2026	medium
363042	Linux Distros 未修补的漏洞：CVE-2026-92821	Nessus	Misc.	10/6/2026	11/7/2026	medium
363042	Linux Distros のパッチ未適用の脆弱性: CVE-2026-92821	Nessus	Misc.	10/6/2026	11/7/2026	medium
363042	Linux Distros Unpatched Vulnerability : CVE-2026-92821	Nessus	Misc.	10/6/2026	11/7/2026	medium
377933	Amazon Linux 2023 : libipa_hbac, libipa_hbac-devel, libsss_autofs (ALAS2023-2026-3416)	Nessus	Amazon Linux Local Security Checks	11/9/2026	11/9/2026	high
376270	SUSE SLES15: libipa_hbac-devel / libipa_hbac0 / libsss_certmap-devel / etc (SUSE-SU-2026:5079-1)	Nessus	SuSE Local Security Checks	11/5/2026	11/5/2026	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

high

high