Security advisory

Authentication bypass vulnerability in LDAP authentication mode

CVE ID : CVE-2026-120985

Details

An authentication bypass vulnerability allowed unauthorized access to the Application when LDAP Authentication mode was enabled and the LDAP server’s “DenyUnauthenticatedBind” setting was set to False.

Impact

When LDAP Authentication mode was enabled in the Application against an LDAP server that permitted unauthenticated binds (DenyUnauthenticatedBind=False), an attacker who knew the username of an LDAP-imported account could gain access to the Application as that user without a password. The server-side LDAP login flow did not adequately enforce password validation, resulting in unauthorized access to the affected account.

How was it resolved?

Server-side validation in the LDAP login flow has been enhanced to enforce credential verification prior to initiating LDAP authentication.

Steps to upgrade

1. Download the latest service pack of your product:
   • AssetExplorer
   • ServiceDesk Plus
2. Apply the latest build to your existing product installation as per the service pack instructions provided in the above links.

Acknowledgements

This vulnerability was reported by Andre through our bug bounty portal.

If you have any questions or concerns, please contact product support.

AssetExplorer: assetexplorer-support@manageengine.com

ServiceDesk Plus: support@servicedeskplus.com