CVE-2026-86345
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-86345 is a critical-severity Improper Restriction of Communication Channel to Intended Endpoints (CWE-923) vulnerability. Its CVSS base score is 9.0 (Critical).
Operationally, ranked at the 30th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-3 (Device Identification and Authentication) and SC-23 (Session Authenticity) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-91139
Vulnerability Data
A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and…
more
whose response is delivered to the client in place of the client's own pending operation's response, due to messageID collision. This can cause a client application to treat a failed authentication (bind) attempt as successful.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires unique identification and authentication of devices before establishing a communications session.
Enforces authenticity of communication sessions so the system only exchanges data with verified intended endpoints.
Protects transmitted information with cryptographic integrity mechanisms that implicitly verify endpoint identity.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Network security controls directly enforce endpoint validation and channel restrictions.
A.8.21 mandates identifying/implementing network service security features (authentication, encryption, connection controls, authorization, monitoring, allowed endpoints via rules) and ensuring providers do so, which stops most improper-restriction cases from being exploitable; the bounded remainder is product-level endpoint validation logic (e.g. cert pinning, strict hostname checks) that lives in code rather than in service configuration or provider agreement.
Cryptography can protect channels but does not guarantee correct endpoint identity without additional controls.
Application security requirements may specify endpoint validation but do not implement it.
A.8.27 mandates security-by-design principles (defense-in-depth, least privilege, assume-breach, never-trust/always-verify, end-to-end encryption, dynamic access control) plus design reviews that can stop many channel-misrouting flaws at source, but leaves a bounded remainder (e.g. flawed protocol selection or implementation bugs in the chosen channel that still reach the wrong endpoint).
Secure coding practices can implement endpoint checks but the control itself is process-oriented.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-923, a class-level weakness. Rules are authored against its narrower children: CWE-419.