Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
MISP is an open source threat intelligence and sharing platform. Prior to 2.5.36, improper neutralization of special elements in an LDAP query in ApacheAuthenticate.php allows LDAP injection via an unsanitized username value when ApacheAuthenticate.apacheEnv is configured to use a user-controlled server variable instead of REMOTE_USER (such as in certain proxy setups). An attacker able to control that value can manipulate the LDAP search filter and potentially bypass authentication constraints or cause unauthorized LDAP queries. This vulnerability is fixed in 2.5.36.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-09 | 1 | Disclosure1 |
| 2026-05-04 | 1 | Patch1 |
CVE-2026-39962 corresponde a un fallo crítico de seguridad identificado en la plataforma MISP (Malware Information Sharing Platform), ampliamente utilizada para el intercambio de inteligencia de amenazas. Se recomienda actualizar a MISP 2.5.36 o superior https://hubs.la/Q04dKcZl0
Post summary
CVE-2026-39962 is a critical flaw in MISP; the advisory recommends upgrading to version 2.5.36 or later to mitigate the vulnerability.
CVE-2026-39962 MISP is an open source threat intelligence and sharing platform. Prior to 2.5.36, improper neutralization of special elements in an LDAP query in ApacheAuthenticate.p… https://www.cve.org/CVERecord?id=CVE-2026-39962
Post summary
The tweet announces CVE‑2026‑39962, a vulnerability in MISP related to LDAP query sanitization, and notes that the issue is fixed in version 2.5.36.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | misp-project | misp | - | - | - |