LDAP CVE-2026-27860

The real-world risk is constrained by multiple factors despite the injection vector itself being serious. The CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N vector indicates network-accessible attack surface with high attack complexity, suggesting specific configuration prerequisites and non-trivial execution requirements. The AC:H (high complexity) rating is the primary dampening factor-exploitation requires not only that auth_username_chars be explicitly emptied (a non-default configuration state) but also successful crafting of LDAP filter syntax compatible with the target directory structure. Confidentiality impact is limited (C:L) while integrity and availability are not affected (I:N/A:N), meaning the vulnerability enables information disclosure and reconnaissance rather than service disruption or data modification. No public exploit code exists and no CISA KEV status indicates active exploitation in the wild. The combination of non-default prerequisite configuration, high attack complexity, and limited real-world impact severity suggests this is a medium-priority remediation item rather than a critical vulnerability, though organizations running intentionally-hardened LDAP configurations without the username character allowlist should prioritize patching. SSVC analysis would classify this as non-critical exploitation (no active evidence) with limited technical impact, placing it below critical severity thresholds.

An attacker targeting an Open-Xchange Dovecot Pro deployment discovers through reconnaissance that LDAP authentication is enabled with an empty auth_username_chars setting. The attacker crafts a login attempt using a username such as '*)(|(uid=*' to inject a filter that returns all valid usernames regardless of password submission, or uses filter patterns like '*))(&' to bypass authentication logic entirely. Due to the high attack complexity requirement, the attacker must either have obtained knowledge of the specific LDAP schema in use or engage in iterative probing to determine valid directory structure. No publicly available exploit code simplifies this process; successful exploitation requires manual LDAP syntax knowledge and system-specific reconnaissance. Once probing succeeds, the attacker gains visibility into the LDAP directory structure and potentially valid user identities, enabling subsequent targeted attacks against identified accounts.