CVE Watch19 de out. de 2026

CVE-2026-89071

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module)

CVSS

7.5

Alta

EPSS

0.5%

p44

KEV

—

Exploit Today

0-100

Publicado: 14 de out. de 2026 · Última mod.: 19 de out. de 2026 · CWE-90

EPSS · 30d

0.4%EPSS · 30 dias0.5%

2026-10-152026-11-05

Descrição técnica

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Referências oficiais

community.progress.comhttps://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-114420—

29.7%

——9SEPPmail Secure Email Gateway before 15.1.1 does not neutralize LDAP metacharacters in an unauthenticated account-selection input in its GINA web interface. A remote unauthenticated attacker can enumerate email addresses.2d CVE-2026-936364.3 MÉD

28.1%

——8An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources through SearchCalendarResourcesRequest. Zimbra escapes search values but inserts the supplied attribute names directly into LDAP filter expressions without validation. An attacker can inject additional conditions and use repeated matching queries to recover readable resource attributes such as internal mailbox hostnames and mail transport routes. The search remains restricted to calendar-resource objects and the LDAP service account's access rights. ZCS 10.1.16 and 10.1.21 are affected.9d CVE-2026-157238.2 ALT

45.8%

——14GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.2d CVE-2026-936355.3 MÉD

15.4%

——5LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME lookups can also return certificates and identity data for unintended directory entries.21d CVE-2026-1102563.7 BAI

31.5%

——9Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. Unauthenticated attackers can submit incremental wildcard patterns such as 'a*' to /api/auth/login and measure response timing to enumerate valid LDAP usernames while evading per-username rate limiting.11d CVE-2026-107595.5 MÉD

16.1%

——5A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations.11d