CVE-2026-47840: A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, then harvest the LDAP bind password and ev
A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, then harvest the LDAP bind password and every end-user password sent during simple-bind authentication, and return forged group memberships that grant themselves admin scopes. This affects every deployment that authenticates users against LDAP over StartTLS.
Affected versions: UAA versions prior to v78.13.0; Cf-deployment versions prior to v56.2.0.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-47840
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-478400.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-47840 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for A network attacker
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- highCVE-2026-38059: The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authenticatio…nvd · 2026-07-10
- mediumCVE-2026-57054: A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of J…nvd · 2026-07-09
- mediumCVE-2026-57032: An Improper Handling of Undefined Parameters vulnerability in the packet forwarding engine (pf…nvd · 2026-07-09
- mediumCVE-2026-57029: A Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Juno…nvd · 2026-07-09
- highCVE-2026-57028: An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Junipe…nvd · 2026-07-09
- mediumCVE-2026-57025: A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of Jun…nvd · 2026-07-09
More from NVD Recent CVEs
- lowCVE-2026-61870: ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memo…2026-07-11
- lowCVE-2026-61861: ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption…2026-07-11
- lowCVE-2026-61858: ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and ext…2026-07-11
- lowCVE-2026-61857: ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing nul…2026-07-11
- lowCVE-2026-61465: ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation…2026-07-11