The flaw in JSS’s JSSTrustManager causes it to ignore trust flags on CA certificates stored in the NSS database. As a result, certificates that lack the TRUSTED_CA flag can be accepted as trust anchors for TLS connections, potentially allowing an attacker to forge certificates and perform a man‑in‑the‑middle attack on PKI client connections. This weakness resides in validation logic and could undermine the integrity of TLS communications.*

The vulnerability affects Red Hat Certificate System 10 and 11, as well as Red Hat Enterprise Linux releases 6 through 10. No more granular version information is provided in the CVE entry. Systems using any of these products are potentially exposed if the flaw exists in their JSS configuration.*

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation in the wild. The likely attack vector requires the attacker to have control over a CA certificate added to the NSS database and to disable certificate revocation verification in the client configuration. In the default configuration, certRevocationVerify is enabled for PKI client connections, which blocks the exploitation path. On the server side, the default TomcatJSS configuration uses JSSNativeTrustManager, which is not affected by this flaw. Therefore, the risk is contingent on non‑default configurations that turn off revocation checking.*