CVE-2026-104048
Redhat Enterprise Linux 10.0 … 9.0
Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-104048 is a medium-severity Comparison Using Wrong Factors (CWE-1025) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 6.8 (Medium).
Operationally, ranked at the 19th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-93942
Vulnerability Data
A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as…
more
an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover incorrect comparison logic after implementation but does not stop the flaw from being written.
Requiring a documented development process and tools can embed standards that reduce introduction of erroneous comparison factors.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC activities such as code review and logic testing directly prevent incorrect comparison factors in code.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle includes requirements and reviews that can catch incorrect comparison logic.
A.8.26 only requires that security requirements (including resilience against injection etc.) be identified and specified during development or acquisition; it does not itself enforce, implement or assure any comparison logic, so the wrong-factor comparison weakness can still be present and exploitable.
Secure coding standards directly address proper comparison logic and factor selection.
Security testing can detect incorrect comparison results during development and acceptance.