How severe is CVE-2026-44063?

CVE-2026-44063 has a CVSS 3.x base score of 4.2, rated medium severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2026-44063 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (12th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-44063?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-44063 have an EU (EUVD) identifier?

Yes. CVE-2026-44063 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-31238.

When was CVE-2026-44063 published?

CVE-2026-44063 was published on 2026-05-21 and last updated on 2026-06-17.

CVE-2026-44063

CVE-2026-44063 is a medium-severity vulnerability with a CVSS 3.x base score of 4.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-90.

Key facts

Severity: Medium (CVSS 3.x base score 4.2)
EPSS exploit prediction: 0% (12th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-31238
Weakness: CWE-90
Published: 2026-05-21
Last modified: 2026-06-17

Description

An LDAP injection vulnerability in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to manipulate LDAP queries and obtain limited information or modify LDAP entries via crafted filter input.

Frequently asked questions

What is CVE-2026-44063?: An LDAP injection vulnerability in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to manipulate LDAP queries and obtain limited information or modify LDAP entries via crafted filter input.
How severe is CVE-2026-44063?: CVE-2026-44063 has a CVSS 3.x base score of 4.2, rated medium severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2026-44063 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (12th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-44063?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-44063 have an EU (EUVD) identifier?: Yes. CVE-2026-44063 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-31238.
When was CVE-2026-44063 published?: CVE-2026-44063 was published on 2026-05-21 and last updated on 2026-06-17.

References

https://netatalk.io/security/CVE-2026-44063

Other CWE-90 (LDAP Injection) vulnerabilities

CVE-2026-44930 — Critical (CVSS 9.8): An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an…
CVE-2026-25560 — Critical (CVSS 9.8): WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied…
CVE-2024-54852 — Critical (CVSS 9.8): When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is…
CVE-2024-33868 — Critical (CVSS 9.8): An issue was discovered in linqi before 1.4.0.1 on Windows. There is LDAP injection.
CVE-2011-4069 — Critical (CVSS 9.8): html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP injection attacks and…
CVE-2017-14596 — Critical (CVSS 9.8): In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username…

Browse all CWE-90 (LDAP Injection) vulnerabilities →