CVE-2026-85983
The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the service account.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.8
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-94
- Published
- 2026-09-08
- Last modified
- 2026-09-08
Affected products
- Auth0 Auth0 AD/LDAP Connector
Weakness type
Related vulnerabilities
- CVE-2026-87817 — GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation
- CVE-2026-41870 — Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)
- CVE-2026-85978 — Unauthenticated Remote Code Execution in Akana API Platform
- CVE-2026-86076 — n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution
- CVE-2026-86083 — n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution
- CVE-2026-78625 — Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard Site Configuration
- CVE-2026-78545 — Improper Input Sanitization in Okta Access Gateway Application Label Configuration
- CVE-2026-69806 — .NET Elevation of Privilege Vulnerability