CVE-2026-104988

Published 2 October 2026 · tracked since 3 October 2026

Description

A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which cause

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-94505 HIGH 8.1
• CVE-2026-96267 HIGH 7.5
• CVE-2026-75028 HIGH 7.5
• CVE-2026-87115 CRITICAL 9.1
• CVE-2026-93889 HIGH 7.2
• CVE-2026-18443 HIGH 8.8
• CVE-2026-100157 MEDIUM 6.5
• CVE-2026-97341 HIGH 7.2
• CVE-2026-96650 HIGH 7.2
• CVE-2026-97337 HIGH 7.5

→ Open the live CVE board · all tools