PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42568 yamcs CVE debrief

CVE-2026-42568 is a MEDIUM severity vulnerability in Yamcs, a mission control framework. An LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping. This vulnerability was patched in versions 5.13.0 and 5.12.7.

Vendor
yamcs
Product
Unknown
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-10
Original CVE updated
2026-07-21
Advisory published
2026-06-10
Advisory updated
2026-07-21

Who should care

Users of Yamcs versions prior to 5.13.0 and 5.12.7 should apply the patches to prevent LDAP injection attacks.

Technical summary

The vulnerability has a CVSS score of 4.3 and is classified as CWE-90. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Defensive priority

MEDIUM

Recommended defensive actions

  • Apply patches in versions 5.13.0 or 5.12.7 to fix the LDAP injection vulnerability.
  • Review and update LDAP authentication configurations to ensure proper escaping of user input.

Evidence notes

The CVE record [cve-org] and NVD detail [nvd] provide official information about the vulnerability. Additional references can be found at [ref-4], [ref-5], and [ref-6].

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42568 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42568

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42568 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42568

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.