SecurityOnlineDo Son
Critical LDAP injection flaw found in Apache Shiro framework
Part of the CVE-2026-49268 story · since 17 Jun
Quiet for 20 weekslast report 17 Jun1 article1 outlet
- Wed 17 Jun, 18:28 UTC. SecurityOnline, first report. Critical LDAP injection flaw found in Apache Shiro framework. This article, 1st of 1.
A critical vulnerability, tracked as CVE-2026-49268, has been discovered in the Apache Shiro framework, specifically within the DefaultLdapRealm class. This LDAP injection flaw poses a significant risk, allowing attackers to manipulate Distinguished Names for user authentication. The vulnerability has a CVSS score of 8.8, indicating high severity, and affects versions up to 2.2.0 and 3.0.0-alpha-0.
Although there is no confirmed exploitation reported yet, administrators are urged to update to the corrected versions (2.2.1 or 3.0.0-alpha-2) to prevent potential breaches.
How the story developed
Quiet for 20 weekslast report 17 Jun1 article1 outlet
1 article from 1 outlet since 17 Jun. Quiet since 17 Jun. This was the first report.
- Wed 17 Jun, 18:28 UTC. SecurityOnline, first report. Critical LDAP injection flaw found in Apache Shiro framework. This article, 1st of 1.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 1 articles as a listHide the list
- Wed 17 JunDay 01
- Critical LDAP injection flaw found in Apache Shiro framework18:28 · SecurityOnline · First report · This article, 1st of 1