# Security advisory

## Authentication bypass vulnerability in LDAP authentication mode

**CVE ID:** CVE-2026-120985

| Product Name | Severity | Affected Version(s) | Fixed Version | Fixed On |
|---|---|---|---|---|
| AssetExplorer | High | 8010 and below | 8020 | October 30, 2026 |
| ServiceDesk Plus | High | 16010 and below | 16020 | October 30, 2026 |

**Details**

An authentication bypass vulnerability allowed unauthorized access to the Application when LDAP Authentication mode was enabled and the LDAP server’s “DenyUnauthenticatedBind” setting was set to False.

**Impact**

When LDAP Authentication mode was enabled in the Application against an LDAP server that permitted unauthenticated binds (`DenyUnauthenticatedBind=False`), an attacker who knew the username of an LDAP-imported account could gain access to the Application as that user without a password. The server-side LDAP login flow did not adequately enforce password validation, resulting in unauthorized access to the affected account.

**How was it resolved?**

Server-side validation in the LDAP login flow has been enhanced to enforce credential verification prior to initiating LDAP authentication.

**Steps to upgrade**

1. Download the latest service pack of your product:
   - [AssetExplorer](https://www.manageengine.com/products/asset-explorer/service-packs.html)
   - [ServiceDesk Plus](https://www.manageengine.com/products/service-desk/on-premises/migration-sequence.html)
2. Apply the latest build to your existing product installation as per the service pack instructions provided in the above links.

**Acknowledgements**

This vulnerability was reported by Andre through our bug bounty portal.

If you have any questions or concerns, please contact product support.

AssetExplorer: [assetexplorer-support@manageengine.com](mailto:assetexplorer-support@manageengine.com)

ServiceDesk Plus: [support@servicedeskplus.com](mailto:support@servicedeskplus.com)