Impact of Node.js vulnerabilities on CA Directory 14.1

Products

• CA Directory

Issue/Introduction

Customers have inquired about the impact of the following Node.js vulnerabilities on CA Directory 14.1:

• CVE-2026-111497
• CVE-2026-106069
• CVE-2026-105483
• CVE-2026-105482

Environment

 

• Product: CA Directory 14.1
• Components: Dxserver, Directory Manager

 

Resolution

The impact of these vulnerabilities depends on the specific component and Service Pack (SP) version in use.

Component Analysis

• Dxserver: This component does not utilize the Node.js library. It is not impacted by the reported vulnerabilities.
• Directory Manager: This component utilizes Node.js and is the only area of the product affected by the reported CVEs.
  
  

Version-Specific Impact

 

Version	Impact Analysis
14.1 SP5	CVE-2026-111497 is exploitable only under specific conditions (requires admin-level OS/network access). Other listed CVEs are not exploitable.
14.1 SP6	Low-medium exploitability for CVE-2026-111497 (affects SCIM). Very low exploitability for CVE-2026-106069. Other CVEs are not exploitable.
14.1 SP7	Low-medium exploitability for CVE-2026-111497 (affects SCIM). Other listed CVEs are not exploitable.

 

Mitigation & Remediation

• Permanent Fix: These vulnerabilities are fully resolved in 14.1 SP8, which includes the latest version of Node.js. Release is targeted for late December 2026.
• Temporary Patch (14.1 SP5 only): A temporary fix is available to mitigate the potential execution of vulnerable code for Directory Manager 14.1 SP5. Please contact Support to obtain the required patch files for the following paths:
  • /app.js
  • /app-scim.js
  • /api-server/controllers/scim-servers.js
  • /scim-server/models/dxmanagement-operations.js

Installation Note: Implementing the SP5 patch requires stopping the Management-UI Node.js service and SCIM Services, replacing the files in their respective locations, and restarting the services.