← Vulnerability feed

Vulnerability record · CVE-2026-34397 · published 1 April 2026

CVE-2026-34397: Himmelblau-idm himmelblau improper privilege management vulnerability

Himmelblau Idm · Himmelblau

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose mapped CN/short name exactly matches a privileged local group name (e.g., "sudo", "wheel", "docker", "adm") can cause the NSS module to resolve that group name to their fake primary group. If the system uses NSS results for group-based authorization decisions (sudo, polkit, etc.), this can grant the attacker the privileges of that group. This issue has been patched in versions 2.3.9 and 3.1.1.

7.0 CVSS 3.1 High EPSS 0.15% · top 96.3% CWE-269 · Improper privilege management
7.0CVSS 3.1 base score
0.15%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose mapped CN/short name exactly matches a privileged local group name (e.g., "sudo", "wheel", "docker", "adm") can cause the NSS module to resolve that group name to their fake primary group. If the system uses NSS results for group-based authorization decisions (sudo, polkit, etc.), this can grant the attacker the privileges of that group. This issue has been patched in versions 2.3.9 and 3.1.1.

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/himmelblau-idm/himmelblau/releases/tag/2.3.9 ProductRelease Notes
https://github.com/himmelblau-idm/himmelblau/releases/tag/3.1.1 ProductRelease Notes
https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-v7xx-7mqc-g835 ExploitMitigationVendor Advisory

Track CVE-2026-34397 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-31957Himmelblau-idm himmelblau insecure default initialization vulnerabilityHimmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 3.0.0 to before 3.1.0, if Himmelblau is deployed without a conf…EPSS 0.73%7.8CVE-2026-31979Himmelblau-idm himmelblau link following vulnerabilityHimmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Prior to 3.1.0 and 2.3.8, the himmelblaud-tasks daemon, running as r…EPSS 0.18%7.1CVE-2025-54882Himmelblau-idm himmelblau insufficiently protected credentials vulnerabilityHimmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himme…EPSS 0.21%9.9CVE-2026-84869ScreenConnect client allows unauthorized file transfer and execution in remote sessionsA flaw in the ConnectWise ScreenConnect client lets files be transferred and executed inside an active remote session without authorization or Host c…KEVEPSS 0.92%analysed9.8CVE-2026-46817Oracle E-Business Suite Payments missing authentication allows takeoverOracle Payments in Oracle E-Business Suite 12.2.3 through 12.2.15 contains an easily exploitable flaw in the File Transmission component. An unauthen…KEVEPSS 0.81%analysed7.8CVE-2026-21533Windows Remote Desktop improper privilege management allows local elevationWindows Remote Desktop contains an improper privilege management flaw (CWE-269) that lets an authorized attacker elevate privileges locally. It affec…KEVEPSS 4.1%analysed5.1CVE-2024-8068Citrix Session Recording privilege escalation to NetworkServiceCitrix Session Recording contains an improper privilege management flaw (CWE-269) that lets an authenticated attacker escalate to the NetworkService …KEVEPSS 3.5%analysed9.8CVE-2024-49035Microsoft Partner Center improper access control allows privilege elevationPartner.Microsoft.com contains an improper access control flaw (CWE-269) that lets an unauthenticated attacker elevate privileges over the network. M…KEVEPSS 1.3%analysed

Source: NIST National Vulnerability Database (record CVE-2026-34397), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.