LDAP Injection in Misp

CVE-2026-39962

MISP is an open source threat intelligence and sharing platform. Prior to 2.5.36, improper neutralization of special elements in an LDAP query in ApacheAuthenticate.php allows LDAP injection via an unsanitized username value when ApacheAuthenticate.apacheEnv is configured to use a user-controlled server variable instead of REMOTE_USER (such as in certain proxy setups). An attacker able to control that value can manipulate the LDAP search filter and potentially bypass authentication constraints or cause unauthorized LDAP queries. This vulnerability is fixed in 2.5.36.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.007 (49.4th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 49.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-39962: held from 0.003 to 0.007.

EPSS over last 30 days · oldest: 0.003 · newest: 0.007 · change: +0.003

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-39962?
CVE-2026-39962 is a critical-severity vulnerability in Misp, classified under LDAP Injection. CVSS score: 9.6/10. Published 2026-04-09.
How severe is CVE-2026-39962?
Critical severity. CVSS v3 base score is 9.6 out of 10.