azure linux pam vulnerabilities

Latest azure linux pam CVEs

Newest publication first

1. CVE-2026-54411 Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison

   Published 2026-06-14

   Medium·CVSS 6.9 EPSS 0.32%

   Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling...

2. CVE-2025-6020 Linux-pam: linux-pam directory traversal

   Published 2025-06-17

   High·CVSS 7.8 EPSS 0.47%

   A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

3. CVE-2024-10963 Pam: improper hostname interpretation in pam_access leads to access control bypass

   Published 2024-11-07

   High·CVSS 7.4 EPSS 0.78%

   A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.