Live › vulnerability › CVE-2026-121021
Axxon One before 3.1.0 stores the password of its LDAP directory service account in plaintext in the main.conf file of the SecurityManager shared configuration. A local attacker who can read that configuration directory or its backups can recover the LDAP account password.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 09:19 UTC. All times on this page are UTC.
Organizations running AxxonSoft Axxon One before 3.1.0 on Windows or Linux that integrate it with an LDAP directory. The exposure requires local read access to the configuration directory or to configuration backups, so the main concern is the servers and backup stores that hold those files. Systems not running Axxon One, or running 3.1.0 or later, are not affected.
No product ranges from the sources yet.
3.1.0main.conf in the SecurityManager shared configuration directory and in any configuration backups, and check whether an LDAP password appears in plaintext3.1.0 or later, per the NVD description (before 3.1.0 is affected)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Plaintext Storage of a Password (CWE-256) in the SecurityManager shared configuration in AxxonSoft Axxon One before 3.1.0 on Windows and Linux allows a local attacker with read access to the configuration directory or to configuration backups to obtain the password of the LDAP directory service account via the main.conf configuration file.
This page as .md · .json · in your agent: get_signal("CVE-2026-121021")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.