An Indian cybersecurity company has disclosed three previously unknown vulnerabilities in one of the most widely deployed identity components in enterprise Linux, and says all three were surfaced by an artificial intelligence model it built in-house for offensive security research.
Bengaluru-based BreachX identified the flaws using Typhon AI Mil v2, a domain-specific model the company developed for tasks such as secure code analysis, vulnerability research and exploit development. The issues were reported to Red Hat under a coordinated vulnerability disclosure process and have been assigned CVE-2026-68742, CVE-2026-68743 and CVE-2026-68744. Red Hat's advisories credit researcher Vivek Parikh of BreachX Zero Day Labs, the company's research division, for the findings.
All three vulnerabilities sit in the System Security Services Daemon, or SSSD, the open-source component enterprise Linux distributions use to authenticate users and connect systems to identity services such as Microsoft Active Directory, LDAP and FreeIPA. Because SSSD underpins login and access decisions across corporate and government fleets, it runs on millions of enterprise Linux systems worldwide. Red Hat lists Red Hat Enterprise Linux 7 through 10 and OpenShift Container Platform 4 among the affected products.
The first flaw, CVE-2026-68742, is an out-of-bounds read in SSSD's NSS responder: the function that parses GETHOSTBYADDR requests fails to validate an address-length field against the remaining packet size, so a crafted request to the responder socket can crash the process. The second, CVE-2026-68743, is a similar unchecked length in the PAM responder's version 1 protocol handling, where a malformed authentication token length triggers an out-of-bounds read and a crash. Red Hat rates both moderate severity, with CVSS scores of 5.5.
The third issue, CVE-2026-68744, is rated low but is arguably the most interesting of the set. The NSS responder pre-allocates reply space for every group entry when answering initgroups lookups, but does not shrink the packet when groups are skipped, so uninitialized heap bytes are sent back to the client. A local user can abuse the behavior to read cached directory data and heap layout information out of the sssd_nss process.
None of the three flaws is remotely exploitable. Each requires local access to the responder sockets, and the direct impact is limited to crashing parts of the authentication service or leaking fragments of process memory. But bugs of this class matter because of where they live: SSSD sits at the heart of enterprise identity infrastructure, service crashes translate into authentication outages, and leaked memory contents can lower the bar for exploiting more serious vulnerabilities elsewhere on the same system.
The method behind the discovery is what sets the disclosure apart. Rather than leaning on conventional fuzzing or manual auditing alone, BreachX says Typhon analyzed SSSD's source code for subtle memory-handling errors, with every candidate finding then validated through manual review and lab testing before being reported. Unlike general-purpose language models, the system is built exclusively for security work, and the company positions it as a sovereign capability: reviewing critical infrastructure code, in its view, is not something to run on somebody else's model under somebody else's terms.
Red Hat has published advisories for all three CVEs and recommends applying updated packages as they become available. At the time of disclosure the company said no practical workaround met its deployment and stability requirements, leaving patching as the only remediation path.
The disclosures also mark a shift in how India's AI ecosystem is developing. While much of the country's investment has gone into sovereign language models and enterprise assistants, BreachX is among a smaller group applying domestic AI to highly technical domains such as vulnerability discovery, where the ability to analyze critical software at scale is becoming a capability in its own right.
