The vulnerability in Red Hat Directory Server 11 arises from the use of a hardcoded static initialization vector (IV) in the LDBM backend attribute encryption for AES-CBC and 3DES-CBC operations. Because the IV is predictable and static, an attacker with privileged access to the filesystem can compare ciphertext blocks to detect when plaintext values are equal across encrypted entries. This weakness compromises confidentiality by leaking information about plaintext equality but does not allow direct plaintext recovery or modification.

An attacker with privileged filesystem access can determine when encrypted attribute values are identical by analyzing ciphertext blocks, potentially aiding further attacks or information disclosure. However, the vulnerability does not allow the attacker to decrypt the data or alter it, so integrity and availability remain unaffected. The CVSS score of 4.4 reflects a medium severity impact focused on confidentiality.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-14969 for current remediation guidance. Until an official fix is available, restrict privileged filesystem access to trusted users only to mitigate the risk of exploitation.