PT-2026-42755

CVE-2026-44930

Published

2026-05-22

Updated

2026-07-20

Description by

CVSS 2.0

Critical

MetricsAV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.1 Apache CXF versions prior to 4.1.6 Apache CXF versions prior to 3.6.11

Description An LDAP injection issue exists in the LDAP Certificate repository of the XKMS server. This allows an attacker to retrieve arbitrary certificates from the repository. LDAP injection is a technique where malicious LDAP statements are used to manipulate queries sent to a directory server.

Recommendations Upgrade to version 4.2.1. Upgrade to version 4.1.6. Upgrade to version 3.6.11.

Exploitability

Exploit

Fix

Impacts

Researchers

Colm O Heigeartaigh

Vendors

Affected products

Weakness enumeration

CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (\'LDAP Injection\')

Related identifiers