What is the CVSS score of EUVD-2026-42035?

EUVD-2026-42035 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Liman MYS are affected by EUVD-2026-42035?

HAVELSAN Liman MYS contains a vulnerability allowing authenticated users to escalate privileges and bypass access controls, potentially exposing sensitive employee directory data and compromising the…

How to fix or mitigate EUVD-2026-42035?

24 hours: Audit all HAVELSAN Liman MYS deployments to identify versions and LDAP/AD integration scope; restrict Liman administrative console access to essential personnel and enable comprehensive logging of all LDAP queries and authentication events. 7 days: Implement strict input validation and sanitization for all LDAP query parameters; deploy network segmentation isolating Liman LDAP connectors from sensitive directory resources; establish baseline monitoring and alerting for anomalous LDAP query patterns. 30 days: Apply HAVELSAN patch for Master.1107 or later when released; execute full regression testing and decommission interim mitigations.

Liman MYS EUVD-2026-42035

| CVE-2026-13696 HIGH

LDAP Injection (CWE-90)

2026-07-07 iletisim@usom.gov.tr

GHSA-44vj-xc6r-j6m3

LDAP Code Injection

8.8

CVSS 3.1 · Vendor: usom

Severity by source

Vendor (usom) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-reachable and low-complexity but requires a valid low-privilege account (PR:L); LDAP injection strongly enables data disclosure and authorization tampering (C:H/I:H), while availability impact is uncertain and rated conservatively (A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (usom).

CVSS VectorVendor: usom

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 12:32 vuln.today

DescriptionCVE.org

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in HAVELSAN Inc. Liman MYS allows LDAP Injection.

This issue affects Liman MYS: before release.Master.1107.

AnalysisAI

Privilege-escalation-capable LDAP injection in HAVELSAN Liman MYS (all releases before Master.1107) lets an authenticated attacker inject unsanitized special characters into LDAP queries, subverting directory-backed authentication and authorization logic. Because Liman is typically wired into corporate LDAP/Active Directory for login, a successful injection can expose directory data, bypass access controls, and manipulate query results. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list; risk is driven by the high CVSS 8.8 rating rather than confirmed in-the-wild activity.

Technical ContextAI

Liman MYS (Management System) is a server/service management panel developed by the Turkish defense-technology firm HAVELSAN, commonly deployed as a centralized administration console that integrates with an organization's LDAP or Active Directory directory service for user authentication and role lookups. The vulnerability is classed as CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query), meaning user-controllable input is concatenated into an LDAP search or bind filter without escaping metacharacters such as (, ), *, \, and NUL. An attacker who controls those bytes can alter the intended filter structure - for example turning a bounded filter into a wildcard or always-true clause - to read attributes they should not see or to influence authorization decisions the directory drives.

RemediationAI

Upgrade Liman MYS to release Master.1107 or later, which is the first fixed release per the vendor advisory (vendor-released patch: Master.1107); consult the USOM bulletin at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0504 for exact upgrade guidance. If immediate patching is not possible, restrict network access to the Liman management interface to trusted administrative networks or a VPN to reduce the pool of low-privilege accounts that can reach the vulnerable endpoints, accepting the trade-off of reduced remote administrative convenience. As a directory-side compensating control, ensure the LDAP service account Liman binds with has least-privilege read scope so an injected filter cannot enumerate sensitive attributes, and enable LDAP query logging to detect anomalous filter patterns; note this does not close the injection but limits blast radius and aids detection.