9.1

CVE-2026-49268: apache software foundation apache shiro LDAP Injection

CVSS: 9.1v3.1CriticalAnalyzed
AliasesUBUNTU-CVE-2026-49268DEBIAN-CVE-2026-49268CGA-46xc-mmv5-qpp4
Published 17-06-2026Last modified 17-06-2026
Open JSON

Vulnerability summary

CVE-2026-49268 is a critical (CVSS 9.1) LDAP Injection vulnerability in apache software foundation apache shiro. EPSS estimates a 0.76% chance of exploitation in the next 30 days, higher than 54.2% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.1/10
010
Critical · v3.1 (NVD)
EPSS score
0.76%
0%100%
Low · +0.26 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-8R9F-84XG-4P6J

Timeline

  1. 17-06-2026
    PublishedVulnerability first disclosed.
  2. 17-06-2026
    Last modifiedVulnerability information updated.

Description

A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users. This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.

CVSS metrics

9 scores · 7 sources · 2 versions

EPSS trend

Probability

0.76%

Chance of exploitation in the next 30 days

Percentile

54%

Versus all other CVEs

30-day change

+0.26 pp

From 0.49% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.76%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard16 products
  • apache-activemq-5.19All versions (No fix recorded)
  • apache-activemq-6.1All versions (No fix recorded)
  • apache-activemq-6.2< 6.2.7-r3
  • apache-activemq-fips-5.19All versions (No fix recorded)
  • apache-activemq-fips-6.1All versions (No fix recorded)
Wolfi3 products
  • neo4j-2025.12All versions (No fix recorded)
  • neo4j-2026.01All versions (No fix recorded)
  • neo4j-2026.05< 2026.05.0-r2
Apache1 product
  • shiro< 2.2.1 | 3.0.0:alpha1
Apache software foundation1 product
  • apache shiro≤ 2.2.0 | ≥ 3.0.0-alpha-0, ≤ 3.0.0-alpha-1
Debian1 product
  • shiroAll versions (No fix recorded)
Org.apache.shiro1 product
  • shiro-core< 2.2.1 | ≥ 3.0.0-alpha-0, < 3.0.0-alpha-2
Ubuntu1 product
  • shiroAll versions (No fix recorded)

7 vendors · 24 products

References

7 links