BaseFortify

Publication date: 2025-10-09

Last updated on: 2026-03-19

Assigner: Red Hat, Inc.

Description

A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-09

Last Modified

2026-03-19

Generated

2026-07-06

AI Q&A

2025-10-09

EPSS Evaluated

2026-07-05

NVD

CVE-2025-11561

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	enterprise_linux	8.2
redhat	enterprise_linux	8.8
redhat	enterprise_linux	9.6
redhat	enterprise_linux	7
redhat	enterprise_linux	10
redhat	enterprise_linux	8.6
redhat	enterprise_linux	9.4
redhat	enterprise_linux	9
redhat	system_security_services_daemon	*
redhat	enterprise_linux	9.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability is a flaw in how Active Directory integrates with the System Security Services Daemon (SSSD) on Linux systems. By default, SSSD does not enable the Kerberos local authentication plugin, which allows an attacker who can modify certain Active Directory attributes (like userPrincipalName or samAccountName) to impersonate privileged users. This means the attacker can gain unauthorized access or escalate privileges on Linux hosts joined to the domain.

Impact Analysis

The vulnerability can lead to unauthorized access or privilege escalation on domain-joined Linux systems. An attacker who can modify specific Active Directory attributes could impersonate privileged users, potentially gaining control over sensitive systems or data.

Hi! I’m here to help you understand CVE-2025-11561. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70