Plaintext Password Storage Vulnerability in AxxonSoft Axxon One
CVE-2026-121021

6.8MEDIUM

Key Information:

Vendor

Axxonsoft

Status
Axxon One
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121021?

A vulnerability in AxxonSoft Axxon One allows local attackers with read access to the configuration directory or its backups to retrieve sensitive passwords stored in plaintext. This affects the SecurityManager shared configuration in versions prior to 3.1.0, exposing the LDAP directory service account's credentials via the main.conf file. Securing this configuration is crucial to prevent unauthorized access.

Affected Version(s)

Axxon One Windows 0 < 3.1.0

References

https://www.axxonsoft.com/legal/axxonsoft-vulnerability-d...
vendor-advisory

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Reported by an AxxonSoft partner.
.