CVE-2026-102156

MediumCVSS 6.8/10Last modified Oct 7, 2026

Description

Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inject queries against the configured directory service.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-74

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 6, 2026
Last modified: Oct 7, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1021575.9An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user CVE-2026-1021586.5Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated networ CVE-2026-1021599.8An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for interna CVE-2026-102163.7A vulnerability was detected in unitedbyai droidclaw up to 0.5.3. The affected element is an unknown function of the file server/src/routes/CVE-2026-1021607.2An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submi CVE-2026-1021618.8An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwar CVE-2026-1021628.8On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wir CVE-2026-1021638.8On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency CVE-2026-1021643.1On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wi CVE-2026-1021657.5On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to CVE-2026-1021668.8Arista C-260 and C-250 access points ship with fleet-wide static cryptographic keys used for firmware image verification and SSLP authentica CVE-2026-1021677.5On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauth