LDAP Injection in Misp
CVE-2026-39962
MISP is an open source threat intelligence and sharing platform. Prior to 2.5.36, improper neutralization of special elements in an LDAP query in ApacheAuthenticate.php allows LDAP injection via an unsanitized username value when ApacheAut…
EPSS: 0.003 (26.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
Affected products
- Misp — versions < 2.5.36
- Misp-project Misp
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Product, x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2026-39962?
- CVE-2026-39962 is a critical-severity vulnerability in Misp, classified under LDAP Injection. CVSS score: 9.6/10. Published 2026-04-09.
- How severe is CVE-2026-39962?
- Critical severity. CVSS v3 base score is 9.6 out of 10.