Live › vulnerability › CVE-2026-121023
The ARP Agent component of AxxonSoft AxxonNet before 3.25.0 writes serialized user synchronization data, including the plaintext password of its LDAP directory service account, into WARNING-level log entries. A local attacker who can read those log files or support packages can recover that LDAP account password.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 09:19 UTC. All times on this page are UTC.
Teams running AxxonNet before 3.25.0 with the ARP Agent component on Windows or Linux, where the agent syncs users against an LDAP directory. Exposure requires a local user with read access to the agent's log files or support packages. Systems without the ARP Agent or already on 3.25.0 or later are not affected.
No product ranges from the sources yet.
3.25.0.3.25.0 or later (per the NVD description; the sources do not name the exact fixed build beyond this).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft AxxonNet before 3.25.0 on Windows and Linux allows a local attacker with read access to ARP Agent log files or support packages to obtain the plaintext password of the LDAP directory service account via WARNING-level log entries that contain serialized user synchronization data.
This page as .md · .json · in your agent: get_signal("CVE-2026-121023")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.