Red Hat Certificate System/Enterprise Linux Trust Manager JSSTrustManager certificate validation

Summaryinfo

A vulnerability has been found in Red Hat Certificate System and Enterprise Linux and classified as problematic. The impacted element is the function JSSTrustManager of the component Trust Manager. This manipulation causes certificate validation. This vulnerability is handled as CVE-2026-78323. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Red Hat Certificate System and Enterprise Linux (the affected version unknown). It has been declared as problematic. Affected by this vulnerability is the function JSSTrustManager of the component Trust Manager. The manipulation with an unknown input leads to a certificate validation vulnerability. The CWE definition for the vulnerability is CWE-295. The product does not validate, or incorrectly validates, a certificate. As an impact it is known to affect integrity. The summary by CVE is:

A flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTED_CA flags to be accepted as trust anchors for TLS connections. In non-default configurations where certificate revocation checking is disabled, this could allow a man-in-the-middle attacker to forge certificates accepted by PKI client connections.

The advisory is shared at access.redhat.com. This vulnerability is known as CVE-2026-78323 since 08/24/2026. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 08/24/2026). MITRE ATT&CK project uses the attack technique T1587.003 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 339073 (Linux Distros Unpatched Vulnerability : CVE-2026-78323), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (339073). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Red Hat

Name

• Certificate System
• Enterprise Linux

License

• open-source

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion