CVE-2026-121021 Details
Description
Plaintext Storage of a Password (CWE-256) in the SecurityManager shared configuration in AxxonSoft Axxon One before 3.1.0 on Windows and Linux allows a local attacker with read access to the configuration directory or to configuration backups to obtain the password of the LDAP directory service account via the main.conf configuration file.
A vulnerability exists in AxxonSoft Axxon One versions prior to 3.1.0 on Windows and Linux, where passwords are stored in plaintext within the SecurityManager shared configuration. This allows local attackers with read access to the configuration directory or backup files to retrieve the password of the LDAP directory service account from the main.conf file.
Users are advised to upgrade to Axxon One version 3.1.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121021 | AxxonSoft | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-256 | Plaintext Storage of a Password | AxxonSoft |
Affected Products
| Product | Versions |
|---|---|
| AxxonSoft Axxon One | < 3.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | AxxonSoft |