CVE-2026-36436
Deferred Deferred - Pending Action

LDAP Credential Exposure in BRPerfX Admin Interface

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: MITRE

Description
An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface. An authenticated administrator can inspect the client-side code to retrieve the credential.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-16
EPSS Evaluated
2026-10-18
NVD
CVE-2026-36436
EUVD
EUVD-2026-102422

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-36436 is a vulnerability in Trisolutions BRPerfX version 1.4.4.0 where LDAP credentials are exposed in plaintext within the administrative configuration interface. An authenticated administrator can retrieve these credentials by inspecting the client-side code using browser developer tools.

Detection Guidance

Check if Trisolutions BRPerfX version 1.4.4.0 is installed. Use browser developer tools (F12) to inspect the administrative configuration interface for plaintext LDAP credentials. Verify if the vendor patch released on February 25, 2026, has been applied.

Impact Analysis

An attacker with administrative access could extract plaintext LDAP credentials, potentially gaining unauthorized access to systems relying on LDAP authentication. This could lead to data breaches, unauthorized system modifications, or lateral movement within a network.

Compliance Impact

This vulnerability could violate compliance requirements that mandate protection of credentials and sensitive data access, such as GDPR (data protection) or HIPAA (health information security). Unauthorized credential exposure may lead to non-compliance penalties.

Mitigation Strategies

Apply the vendor patch released on February 25, 2026. Restrict access to the administrative configuration interface to authorized personnel only. Rotate any exposed LDAP credentials immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-36436. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart