CVE-2026-121023

MEDIUM 5.5

LDAP Bind Password Exposure in AxxonNet ARP Agent Logs

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft AxxonNet before 3.25.0 on Windows and Linux allows a local attacker with read access to ARP Agent log files or support packages to obtain the plaintext password of the LDAP directory service account via WARNING-level log entries that contain serialized user synchronization data.

CWE	CWE-532
Vendor	axxonsoft
Product	axxonnet arp agent
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for axxonsoft axxonnet arp agent

Be the first to know when new medium vulnerabilities affecting axxonsoft axxonnet arp agent are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

AxxonSoft / AxxonNet ARP Agent

0 < 3.25.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

axxonsoft.com: https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121023

Credits

Discovered internally by the AxxonSoft development team.