Which versions of PHP are affected by CVE-2026-39962?

MISP (Malware Information Sharing Platform) versions before 2.5.36 contain an LDAP injection vulnerability that allows unauthenticated attackers to bypass authentication and access threat…. A patch is available.

How to fix or mitigate CVE-2026-39962?

Within 24 hours: Identify all MISP instances and document which are deployed with Apache authentication using apacheEnv configuration (review ApacheAuthenticate.php settings and proxy configurations). Within 7 days: Upgrade all vulnerable MISP instances to version 2.5.36 or later; if immediate upgrade is not feasible, restrict network access to MISP to trusted internal subnets only. Within 30 days: Audit LDAP authentication logs for suspicious authentication attempts and validate that all instances are running patched versions.

PHP CVE-2026-39962

Q: What is the CVSS score of CVE-2026-39962?

CVE-2026-39962 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-20966 HIGH

LDAP Injection (CWE-90)

2026-04-09 GitHub_M

PHP Authentication Bypass LDAP Code Injection Misp

8.8

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:23 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:00 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.5.36

EUVD ID Assigned

Apr 09, 2026 - 17:15 euvd

EUVD-2026-20966

Analysis Generated

Apr 09, 2026 - 17:15 vuln.today

CVE Published

Apr 09, 2026 - 16:37 nvd

HIGH 8.8

DescriptionCVE.org

MISP is an open source threat intelligence and sharing platform. Prior to 2.5.36, improper neutralization of special elements in an LDAP query in ApacheAuthenticate.php allows LDAP injection via an unsanitized username value when ApacheAuthenticate.apacheEnv is configured to use a user-controlled server variable instead of REMOTE_USER (such as in certain proxy setups). An attacker able to control that value can manipulate the LDAP search filter and potentially bypass authentication constraints or cause unauthorized LDAP queries. This vulnerability is fixed in 2.5.36.

AnalysisAI

LDAP injection in MISP (Malware Information Sharing Platform) versions prior to 2.5.36 enables unauthenticated attackers to bypass authentication and execute unauthorized LDAP queries. The vulnerability exists in ApacheAuthenticate.php when administrators configure apacheEnv to use user-controlled server variables instead of REMOTE_USER in proxy deployments. Attackers manipulate unsanitized username values to inject special characters into LDAP search filters, potentially gaining unauthorized access to the threat intelligence platform. No public exploit identified at time of analysis.

Technical ContextAI

CWE-90 LDAP injection occurs through insufficient input validation in the ApacheAuthenticate module. When apacheEnv reads username from attacker-controlled HTTP headers (non-default proxy configurations), special LDAP filter metacharacters bypass sanitization. The injection point exists in LDAP query construction during authentication, allowing filter manipulation through crafted username strings containing characters like parentheses, asterisks, or ampersands that alter query logic.

RemediationAI

Vendor-released patch: MISP version 2.5.36 resolves this vulnerability through commits 380ee4136a7d9ce2fe63fce06d517839f30aba10 and d7d671ea8f5822e91207dcad2003c35c30092a32. Upgrade immediately to v2.5.36 or later from https://github.com/MISP/MISP/releases/tag/v2.5.36. For environments unable to upgrade immediately, revert ApacheAuthenticate.apacheEnv configuration to use default REMOTE_USER variable instead of custom server variables, or disable ApacheAuthenticate module and use alternative authentication mechanisms. Review LDAP authentication logs for suspicious username patterns containing LDAP metacharacters. Consult vendor advisory at https://github.com/MISP/MISP/security/advisories/GHSA-mc53-48w8-9g63 for detailed mitigation guidance.