Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-07 | 1 | Disclosure1 |
| 2026-09-08 | 2 | General1PoC1 |
| 2026-09-09 | 1 | Patch1 |
[CVE] CVE-2026-18922 [HIGH PRIORITY] #389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalati... 🔗 https://exploitgrid.net/cve/CVE-2026-18922
Post summary
CVE‑2026‑18922 is a privilege‑escalation flaw in 389‑ds-base’s SASL plain authentication, flagged as high priority and accompanied by a publicly available PoC.
🛡️ #ExploitGrid Daily Threat Digest Top #Vulnerabilities (#CVEs) of the day CVE-2026-44756 CVE-2026-75650 CVE-2026-86296 CVE-2026-18922 CVE-2026-58240 ..🧵👇
Post summary
The tweet merely enumerates CVE identifiers without providing context about exploitation, patches, or technical details.
🚨 CRITICAL: CVE-2026-18922 (CVSS 9.8) - 389 Directory Server SASL authentication flaw allows attackers to gain Directory Manager privileges without valid credentials. Immediate patching required. #CVE #Vulnerability #PatchNow #ThreatIntel #DFIR https://t.co/66cP9IFR7C
Post summary
The tweet highlights a critical CVE-2026-18922 vulnerability, provides technical details, and stresses the urgency of applying a patch.
CVE-2026-18922 A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attem… https://www.cve.org/CVERecord?id=CVE-2026-18922
Post summary
The post discloses CVE‑2026‑18922, describing a flaw in 389 Directory Server’s SASL authentication, but provides no PoC, exploit, active use, or patch details.