What is CVE-2026-85983?

CVE-2026-85983 is a high-severity vulnerability in Auth0 Ad/ldap Connector, classified under Code Injection. CVSS score: 7.8/10. Published 2026-09-08.

How severe is CVE-2026-85983?

High severity. CVSS v3 base score is 7.8 out of 10.

RCE in Auth0 Ad/ldap Connector

CVE-2026-85983

The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the service account.

Vulnerability class: RCE (Remote Code Execution)

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Auth0 Ad/ldap Connector

Weakness classification (CWE)

CWE-94 — Code Injection

References

psirt@okta.com

Frequently asked questions

What is CVE-2026-85983?: CVE-2026-85983 is a high-severity vulnerability in Auth0 Ad/ldap Connector, classified under Code Injection. CVSS score: 7.8/10. Published 2026-09-08.
How severe is CVE-2026-85983?: High severity. CVSS v3 base score is 7.8 out of 10.