CVE-2026-75879: Multiple vulnerabilities in IBM Content Navigator and FasterXML jackson-databind in IBM Content Navigator

Q: Who can exploit this issue?

A remote attacker must be authenticated to IBM Content Navigator. No user interaction is required.

Q: What can an attacker gain through exploitation?

An attacker can send a specially crafted request to perform LDAP injection and enumerate LDAP directory information. The provided severity vector indicates low confidentiality impact, with no integrity or availability impact.

Q: Which IBM Content Navigator versions are identified as affected?

The affected versions listed are 3.0.15.0, 26.0.0.0, 3.1.0.0, and 3.2.0.0.

Published Nov 2, 2026

Updated

IBM Content Navigator 3.0.15.0, 26.0.0.0, 3.1.0.0, and 3.2.0.0 is vulnerable to LDAP injection. A remote authenticated attacker could send a specially crafted request that could allow enumeration of LDAP directory information.

Other sources

IBM Content Navigator is vulnerable to LDAP injection. A remote authenticated attacker could send a specially crafted request that could allow enumeration of LDAP directory information.

— IBM

Affected Software

4 affected componentsFixes available

IBM Content Navigator<=3.0.15.0

IBM Content Navigator<=26.0.0.0

IBM Content Navigator<=3.1.0.0

IBM Content Navigator<=3.2.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Content Navigator to a version that resolves this vulnerability.
Patch 3.0.15-IF011
Upgrade
Upgrade IBM Content Navigator to a version that resolves this vulnerability.
Patch 26.0.0-IF004
Upgrade
Upgrade IBM Content Navigator to a version that resolves this vulnerability.
Patch 3.1.0-IF013
Upgrade
Upgrade IBM Content Navigator to a version that resolves this vulnerability.
Patch 3.2.0-IF008

Event History

Nov 2, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·06:38 PM

Data Sourced

via MITRE·06:38 PM

RemedyDescriptionSeverity

Data Sourced

via NVD·07:17 PM

DescriptionSeverity

Parent advisories

This vulnerability appears in the following advisories.

IBM-7295227

Frequently Asked Questions

Who can exploit this issue?

A remote attacker must be authenticated to IBM Content Navigator. No user interaction is required.

What can an attacker gain through exploitation?

An attacker can send a specially crafted request to perform LDAP injection and enumerate LDAP directory information. The provided severity vector indicates low confidentiality impact, with no integrity or availability impact.

Which IBM Content Navigator versions are identified as affected?

The affected versions listed are 3.0.15.0, 26.0.0.0, 3.1.0.0, and 3.2.0.0.

CVE-2026-75879: Multiple vulnerabilities in IBM Content Navigator and FasterXML jackson-databind in IBM Content Navigator

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who can exploit this issue?

What can an attacker gain through exploitation?

Which IBM Content Navigator versions are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker gain through exploitation?

Which IBM Content Navigator versions are identified as affected?