Axxon One CVE-2026-121021

Exploitation requires LOCAL read access to the Axxon One SecurityManager shared configuration directory or to a configuration backup, so that the attacker can open the main.conf file where the LDAP directory service account password is stored in plaintext. The vulnerability is only impactful when Axxon One (versions before 3.1.0, on Windows or Linux) is configured to integrate with an LDAP directory service account - if no LDAP account credential is stored, there is nothing to disclose. Limiting factors: there is no remote/network vector (AV:L), the attacker must already possess at least low-level privileges granting filesystem read access to the config or backups (PR:L), no user interaction is involved, and only confidentiality of the stored LDAP credential is at stake (no integrity or availability impact).

This is a genuine but moderate, self-reported disclosure issue rather than an urgent emergency. The input CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H) makes the real-world preconditions clear: exploitation is LOCAL and requires the attacker to already hold at least low privileges (PR:L) - specifically read access to the Axxon One configuration directory or to configuration backups. There is no remote network path and no scope change. The impact is confined to confidentiality (VC:H, with VI:N/VA:N): the attacker recovers the stored LDAP service-account password, which can then be abused for lateral movement against the directory - a meaningful downstream consequence, but one that follows from an already-privileged local foothold rather than from this flaw directly. On the decision signals: the vendor-assigned priority is 'this_month' (not act_now/emergency); there is NO CISA KEV listing and NO EPSS score supplied, and no public exploit or PoC reference is present in the input. These signals are consistent with each other - a credential-at-rest exposure requiring local read access is unlikely to see widespread automated exploitation. The CVSS and the description agree (both point to local access), so there is no vector/description conflict to flag. The main caveats are gaps rather than contradictions: EPSS and KEV data are simply absent from the input (absence is not evidence of low risk), and the only source is the vendor's own advisory. Net: a real credential-hygiene priority for environments where Axxon One integrates with LDAP, but not a drop-everything issue.

An attacker or malicious insider who has obtained read access to the Axxon One host's configuration directory - or who has acquired a configuration backup archive - opens the main.conf file in the SecurityManager shared configuration and reads the LDAP directory service account password stored in plaintext. They then reuse those credentials to authenticate to the directory service and pivot to other systems. No public exploit is required: the attack is simply reading a file, but it presupposes the local/backup access that CVSS AV:L and PR:L reflect.