CVE-2026-47840

Katalog CVE

CVSS 7.5 · High EPSS 0,22%

Skor CVSS 3.1 7.5 (High) menurut vmware.com.

Deskripsi (NVD)

A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, then harvest the LDAP bind password and every end-user password sent during simple-bind authentication, and return forged group memberships that grant themselves admin scopes. This affects every deployment that authenticates users against LDAP over StartTLS. Affected versions: UAA versions prior to v78.13.0; Cf-deployment versions prior to v56.2.0.

Rincian

Terbit di NVD

9 Juli 2026

Terakhir diubah

9 Juli 2026

Status NVD

Awaiting Analysis

CVSS 3.1

7.5 (High), sumber vmware.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N · uraikan di kalkulator

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 11,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://www.cloudfoundry.org/blog/cve-2026-47840-ldap-starttls-unconditionally-disables-hostname-verification/