RHSA-2026:95182: Important: pki-core security update
Important: pki-core security update
Other sources
The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.Security Fix(es): pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content (ExternalProcessConstraint) (CVE-2026-76561) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/pki-coreto a version that resolves this vulnerability.Fixed in 10.5.18-32.el7_9.1 - Upgrade
Upgrade
redhat/pki-baseto a version that resolves this vulnerability.Fixed in 10.5.18-32.el7_9.1 - Upgrade
Upgrade
redhat/pki-base-javato a version that resolves this vulnerability.Fixed in 10.5.18-32.el7_9.1 - Upgrade
Upgrade
redhat/pki-cato a version that resolves this vulnerability.Fixed in 10.5.18-32.el7_9.1 - Upgrade
Upgrade
redhat/pki-core-debuginfoto a version that resolves this vulnerability.Fixed in 10.5.18-32.el7_9.1 - Upgrade
Upgrade
redhat/pki-javadocto a version that resolves this vulnerability.Fixed in 10.5.18-32.el7_9.1 - Upgrade
Upgrade
redhat/pki-krato a version that resolves this vulnerability.Fixed in 10.5.18-32.el7_9.1 - Upgrade
Upgrade
redhat/pki-serverto a version that resolves this vulnerability.Fixed in 10.5.18-32.el7_9.1 - Upgrade
Upgrade
redhat/pki-symkeyto a version that resolves this vulnerability.Fixed in 10.5.18-32.el7_9.1 - Upgrade
Upgrade
redhat/pki-toolsto a version that resolves this vulnerability.Fixed in 10.5.18-32.el7_9.1
Event History
Frequently Asked Questions
What capability does an attacker need to exploit this issue?
The issue is triggered through certprofile-import and unsanitized profile content processed by ExternalProcessConstraint. Exploitation therefore requires the ability to provide or import a malicious certificate profile through that workflow.
What is the potential impact of successful exploitation?
Successful exploitation can result in code execution. The advisory classifies the update as Important and assigns a high severity rating of 7.
Which environments are identified as affected by this advisory?
The advisory lists pki-core and related packages including pki-tools, pki-symkey, and pki-core-debuginfo. It also identifies Red Hat Enterprise Linux Server Extended Life Cycle Support offerings, including IBM Power (little- and big-endian) and IBM z Systems.