Red Hat Patches Certificate System Flaw That Allows Code Execution Through Imported Profiles
Red Hat published security advisory RHSA-2026:86625 on 21 October 2026, delivering an updated pki-core package for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. The advisory is rated Important by Red Hat Product Security and addresses a single flaw, CVE-2026-76561, described as a Dogtag/PKI issue in which certprofile-import allows code execution via unsanitized profile content through ExternalProcessConstraint. The pki-core packages provide the foundational components of Red Hat Certificate System, meaning the affected software is the certificate authority machinery itself rather than a peripheral utility. Affected builds span a wide set of long-lifecycle channels, including RHEL Server AUS 9.2 on x86_64, RHEL for x86_64 and Power LE under Update Services for SAP Solutions 9.2, RHEL for ARM 64 and IBM z Systems with four years of updates, and the Extended Life Cycle streams for x86_64, aarch64, ppc64le and s390x. The fixed release is pki-core-11.3.0-3.el9_2, shipping the corresponding idm-pki-acme, idm-pki-base, idm-pki-ca, idm-pki-est, idm-pki-java, idm-pki-kra, idm-pki-server, idm-pki-tools and python3-idm-pki binaries.
Red Hat has not published a step-by-step exploitation chain in the errata text, and the advisory directs readers to the CVE page for the CVSS base score, impact statement and acknowledgements rather than reproducing them. What the advisory does state plainly is the mechanism at the centre of the issue: the certprofile-import function, which loads certificate profile configuration into the certificate authority, does not sanitize the content it accepts, and that unsanitized content can reach ExternalProcessConstraint, a profile constraint type whose purpose is to invoke an external process. The consequence named by Red Hat is code execution. Because profile handling is a server-side administrative function of the CA subsystem, the exposure sits with the idm-pki-ca and idm-pki-server components running under the PKI Tomcat instance rather than with client tooling. The associated Bugzilla tracking record is BZ 2519523, and the advisory lists no workaround or interim mitigation, only the updated packages.
A certificate authority is one of the highest-value services in an enterprise estate, because whatever runs with its privileges can influence the issuance decisions that the rest of the environment trusts. Code execution in the context of the CA service therefore carries implications well beyond a single host, touching identity, machine authentication and any system that validates certificates issued by that authority. The affected channels make this particularly relevant to conservative, slow-moving estates: AUS, Extended Life Cycle and Update Services for SAP Solutions streams exist precisely because the systems on them cannot be rebuilt or rebased easily, and SAP-adjacent infrastructure is frequently business critical. On current exploitation status, FIRST EPSS places CVE-2026-76561 at a 0.7 percent probability of exploitation in the next 30 days, and no in-the-wild activity is described in the advisory or in the verified evidence available to us. The practical risk picture is therefore a serious potential impact on a sensitive service, paired with a low near-term exploitation likelihood and a vendor fix already available across every affected architecture.
Attack Surface
Server OS, Infrastructure, System Management Service
Tactics
Execution, Privilege Escalation, Credential Access
Techniques
- T1059 – Command and Scripting Interpreter
- T1505 – Server Software Component
- T1649 – Steal or Forge Authentication Certificates
SuperPRO's Threat Countermeasures Procedures
- Update pki-core and its subpackages to 11.3.0-3.el9_2 on all RHEL 9.2 AUS, Extended Life Cycle and Update Services for SAP Solutions hosts, covering idm-pki-base, idm-pki-ca, idm-pki-server, idm-pki-kra, idm-pki-acme, idm-pki-est, idm-pki-java, idm-pki-tools and python3-idm-pki, as listed in RHSA-2026:86625.
- Inventory exposure first with 'rpm -q idm-pki-server idm-pki-ca pki-core' across the estate and flag any host returning a version earlier than 11.3.0-3.el9_2; the advisory covers x86_64, ppc64le, aarch64 and s390x builds, so include non-Intel SAP and mainframe nodes.
- Restrict who can call certprofile-import by reviewing membership of the Certificate Manager Agents and Administrators groups in the CA instance, and remove any service or shared account that does not require profile management rights.
- Limit network reach to the Red Hat Certificate System administrative endpoints exposed by idm-pki-server with firewalld rules or host ACLs, so that only named management subnets and jump hosts can reach the CA subsystem on affected RHEL 9.2 AUS, Extended Life Cycle and Update Services for SAP Solutions hosts.
- Audit the existing profile definitions under /var/lib/pki/<instance>/ca/profiles/ca/ for any constraint entry referencing ExternalProcessConstraint and treat unexpected or recently modified profiles as an investigation item against Bugzilla BZ 2519523.
- Add an auditd or EDR rule that alerts when the Java process running the idm-pki-server CA service spawns a child shell or interpreter such as /bin/sh, /bin/bash or /usr/bin/python3, since code execution via unsanitized profile content reaching ExternalProcessConstraint would surface as exactly that process lineage.
- Review the CA transaction and debug logs in /var/log/pki/<instance>/ca/ for profile import events and for service restarts that do not correlate with an approved change record, and retain those logs for the period preceding the 21 October 2026 patch date.
