CVE-2026-121021

MEDIUM 5.5

Plaintext Storage of LDAP Password in Axxon One Shared Configuration

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

Plaintext Storage of a Password (CWE-256) in the SecurityManager shared configuration in AxxonSoft Axxon One before 3.1.0 on Windows and Linux allows a local attacker with read access to the configuration directory or to configuration backups to obtain the password of the LDAP directory service account via the main.conf configuration file.

CWE	CWE-256
Vendor	axxonsoft
Product	axxon one
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for axxonsoft axxon one

Be the first to know when new medium vulnerabilities affecting axxonsoft axxon one are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

AxxonSoft / Axxon One

0 < 3.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

axxonsoft.com: https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121021

Credits

Reported by an AxxonSoft partner.