First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-121023

MediumCVSS 5.5/10Last modified Nov 3, 2026

Description

Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft AxxonNet before 3.25.0 on Windows and Linux allows a local attacker with read access to ARP Agent log files or support packages to obtain the plaintext password of the LDAP directory service account via WARNING-level log entries that contain serialized user synchronization data.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
AxxonSoft	AxxonNet ARP Agent	< 3.25.0

References

https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121023

Timeline

Published: Nov 3, 2026
Last modified: Nov 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1210245.4Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in CVE-2026-1210285.3Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Chill Strong Testimonials strong-testimoni CVE-2026-1210294.3Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML CVE-2026-121034.3The Wallet for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.4. This is d CVE-2026-1210309.6Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to poten CVE-2026-1210316.5Missing authorization in PDF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy into a privileged CVE-2026-1210327.4Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafte CVE-2026-1210336.5Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the render CVE-2026-1210349.6Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to exe CVE-2026-1210359.6Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox CVE-2026-1210368.8Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a c CVE-2026-1210379.6Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrar

CVE-2026-121023: Medium severity, CVSS 5.5 | Vulnix