Cyber Resilience

CVE-2026-41076

High

Published: 22 May 2026

Published
22 May 2026
Modified
26 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0039 31.1th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-41076 is a high-severity Improper Authentication (CWE-287) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A07:2025 Authentication Failures

EU & UK References

Vulnerability details

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.9 and prior in addition to 6.0.0 through 6.0.2 contain an authentication bypass vulnerability in RT installations that use LDAP/AD for user authentication. Under certain LDAP server configurations,…

more

an attacker may be able to authenticate as any LDAP-backed RT user without supplying valid credentials. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by reviewing their LDAP server's authentication policy to ensure it rejects unauthenticated bind attempts. Upgrading RT remains the recommended fix.

CWE(s)
CWE-287

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
Why these techniques?

Authentication bypass in public-facing RT web app directly enables T1190; allows use of any valid LDAP account without credentials, enabling T1078.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-9 Previous Logon Notification
addresses: CWE-287

Detects unauthorized successful logons resulting from improper authentication implementations.

AT-1 Policy and Procedures
addresses: CWE-287

Documented procedures ensure personnel are trained on authentication mechanisms, tangibly lowering the risk of improper authentication being exploited.

AT-2 Literacy Training and Awareness
addresses: CWE-287

Security awareness training instructs users on secure authentication practices and avoiding credential compromise.

AT-3 Role-based Training
addresses: CWE-287

Training on authentication mechanisms and best practices decreases the occurrence of improper authentication.

AU-10 Non-repudiation
addresses: CWE-287

Non-repudiation requires strong authentication mechanisms to irrefutably attribute performed actions to specific individuals or processes.

AU-14 Session Audit
addresses: CWE-287

Session content review can reveal authentication bypasses or failures in session establishment.

AU-6 Audit Record Review, Analysis, and Reporting
addresses: CWE-287

Review of authentication-related audit records can detect improper authentication mechanisms or bypasses.

CA-2 Control Assessments
addresses: CWE-287

Assessments check authentication mechanisms for correct implementation and effectiveness, reducing successful authentication bypass attempts.

References