CVE Watch10 de nov. de 2026

CVE-2026-111262

The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A r

CVSS

—

Sem CVSS

EPSS

0.2%

p13

KEV

—

Exploit Today

0-100

Publicado: 10 de nov. de 2026 · Última mod.: 10 de nov. de 2026 · CWE-90

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A remote unauthenticated attacker can alter the queries to enumerate accounts, infer directory attribute values, or influence which directory entry the login is validated against. Only applications using the LDAP identity store are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Referências oficiais

lists.apache.orghttps://lists.apache.org/thread.html/qrfq68g2znq773z7g960qsckldvtkqzd

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1262408.2 ALT

—

———A improper neutralization of special elements used in an ldap query ('ldap injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to bypass authentication. Successful exploitation requires either a malicious/compromised upstream IdP, or an IdP configuration that allows the user to control the NameID (or the SAML attribute used as the username).4h CVE-2026-758794.3 MÉD

23.8%

——7IBM Content Navigator 3.0.15.0, 26.0.0.0, 3.1.0.0, and 3.2.0.0 is vulnerable to LDAP injection. A remote authenticated attacker could send a specially crafted request that could allow enumeration of LDAP directory information.2d CVE-2026-173929.9 CRÍ

51.8%

——16IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant.15h CVE-2026-173895.3 MÉD

36.5%

——11IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information from the connected LDAP directory due to LDAP injection. Input is not properly neutralized in directory lookups, which could cause queries to return additional data.4d CVE-2026-172144.8 MÉD

27.5%

——8IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to LDAP injection.5d CVE-2026-114420—

29.9%

——9SEPPmail Secure Email Gateway before 15.1.1 does not neutralize LDAP metacharacters in an unauthenticated account-selection input in its GINA web interface. A remote unauthenticated attacker can enumerate email addresses.2d