CVE-2018-11049: RSA Identity Governance and Lifecycle Uncontrolled Search Path Vulnerability

Security readout for executives and security teams

This CVE describes a local privilege-risk issue in RSA identity governance products. Installation scripts set an environment variable incorrectly, creating an uncontrolled search path condition. A malicious authenticated local user could try to trick root into running malicious code. Business urgency depends on whether affected RSA deployments exist and whether local users can access them. Exposure is limited to the listed RSA versions and deployment types: hardware appliance, software bundle or soft-appliance, and virtual application where specified. Cloud-only or unlisted deployments are not supported by the provided evidence. Treat this as a targeted local privilege-escalation risk, not a broad remote emergency. Prioritize inventory and vendor guidance checks where RSA identity governance systems support privileged identity workflows or shared administrative access. Mitigation focus: Inventory RSA IGL, Via Lifecycle and Governance, and RSA IMG deployments.; Check vendor advisory DSA-2018-117 for supported fixes or hardening guidance.; Restrict local shell access to affected appliances and software-bundle hosts..

Prepared

Jun 7, 2026, 13:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.