CVE-2026-36436

7.5High

Published 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-522

Impact

Authenticated administrators can extract plaintext LDAP service account credentials directly from the web UI. This requires administrative login access to the BRPerfX interface.

Root cause

The administrative configuration interface includes raw LDAP credentials in plaintext within client-side code delivered to the browser.

Affected systems

Trisolutions BRPerfX version 1.4.4.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade to a fixed release once provided by Trisolutions. As an immediate mitigation, rotate exposed LDAP service credentials and scope the LDAP service account to minimal read-only directory permissions.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface. An authenticated administrator can inspect the client-side code to retrieve the credential.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-36436