Red Hat Security Advisory: pki-core:10.6 security update

CVE-2026-76561 is a vulnerability in the pki-core:10.6 module of Red Hat Enterprise Linux 8, specifically in the Dogtag/PKI certprofile-import functionality. The flaw allows code execution through unsanitized profile content, representing a command injection risk (CWE-78). Red Hat has released an important security update (RHSA-2026:75573) that fixes this issue by sanitizing input and preventing arbitrary code execution. The advisory covers multiple architectures and extended life cycle versions of Red Hat Enterprise Linux 8. No active exploitation has been reported, but the vulnerability is rated high severity.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on affected systems via crafted profile content in the certprofile-import feature of Dogtag/PKI. This could lead to unauthorized system control or compromise of the Public Key Infrastructure services. However, there are no known exploits in the wild at this time.

Red Hat has released an official security update for pki-core:10.6 as part of Red Hat Enterprise Linux 8 to address CVE-2026-76561. Users should apply the update referenced in Red Hat Advisory RHSA-2026:75573 promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patch.