CVE-2026-18147
High
Description
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.
SeverityHigh
CVSS8.1
Exploit probability—
Product
Red Hat Enterprise Linux 10
PublishedSep 9, 2026
First seenSep 9, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Vendor advisories
- access.redhat.com/errata/RHSA-2026:70564
- access.redhat.com/errata/RHSA-2026:72279
- access.redhat.com/errata/RHSA-2026:82935
- access.redhat.com/errata/RHSA-2026:83083
- access.redhat.com/errata/RHSA-2026:83084
- access.redhat.com/errata/RHSA-2026:83085
- access.redhat.com/errata/RHSA-2026:83460
- access.redhat.com/errata/RHSA-2026:83461
- access.redhat.com/errata/RHSA-2026:89836
- access.redhat.com/errata/RHSA-2026:93071
- access.redhat.com/errata/RHSA-2026:93452
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Red Hat Enterprise Linux 10 | No range specified | — |
| Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support | No range specified | — |
| Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support | No range specified | — |
| enterprise_linux 8 | No range specified | — |
| rhel_aus 8.4 | No range specified | — |
| rhel_aus 8.6 | No range specified | — |
| rhel_e4s 8.8 | No range specified | — |
| enterprise_linux 9 | No range specified | — |
| rhel_e4s 9.2 | No range specified | — |
| rhel_e4s 9.4 | No range specified | — |
| rhel_eus 9.6 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.