CVE-2026-121021
Received Received - Intake

Plaintext Password Storage in AxxonSoft Axxon One

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: AxxonSoft

Description
Plaintext Storage of a Password (CWE-256) in the SecurityManager shared configuration in AxxonSoft Axxon One before 3.1.0 on Windows and Linux allows a local attacker with read access to the configuration directory or to configuration backups to obtain the password of the LDAP directory service account via the main.conf configuration file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121021
EUVD
EUVD-2026-115714

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
AxxonSoft Axxon One 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-256 The product stores a password in plaintext within resources such as memory or files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the plaintext storage of a password in the SecurityManager shared configuration file (main.conf) in AxxonSoft Axxon One versions before 3.1.0. A local attacker with read access to the configuration directory or backups can retrieve the LDAP directory service account password.

Detection Guidance

Check the main.conf configuration file in the SecurityManager shared configuration directory for plaintext storage of LDAP directory service account passwords. Look for entries in the file that may contain passwords without encryption.

Impact Analysis

An attacker could gain unauthorized access to the LDAP directory service account, potentially compromising sensitive data or system integrity. This could lead to data breaches, unauthorized modifications, or further network infiltration.

Compliance Impact

This vulnerability may violate compliance requirements such as GDPR (data protection) and HIPAA (health information security) due to unauthorized access to sensitive data. Organizations could face legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade AxxonSoft Axxon One to version 3.1.0 or later to address the plaintext password storage issue. Ensure configuration files are secured with proper access controls to prevent unauthorized read access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121021. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...