Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations. This issue was fixed in PAC4J versions 4.5.10, 5.7.10 and 6.4.1
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-17 | 1 | Active Exploitation1 |
| 2026-04-19 | 1 | Disclosure1 |
Attention, elevated activities detected targeting PAC4J (CVE-2026-40459) https://vuldb.com/vuln/358078/cti
Post summary
The message indicates that elevated activity has been detected against PAC4J (CVE-2026-40459), suggesting active exploitation, but it does not provide PoC, exploit code, patch information, or detailed technical specifics.
CVE-2026-40459 PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentiall… https://www.cve.org/CVERecord?id=CVE-2026-40459
Post summary
The text announces that PAC4J is vulnerable to LDAP Injection, detailing how a low‑privileged remote attacker may exploit it, but it provides no PoC, exploitation evidence, or remediation steps.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pac4j | pac4j | - | - | - |