Is CVE-2026-101145 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101145 being exploited in the wild.

How severe is CVE-2026-101145?

Medium severity, with a CVSS score of 4.3, published 28 September 2026.

Which products and versions are affected?

Eleveo Call Recording Software 9.7.0.

Is there a fix for CVE-2026-101145?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-101145 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-101145?

Check whether you run Eleveo Call Recording Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101145: Eleveo Call Recording Software LDAP injection in user management

CVE-2026-101145 · Severity: medium · CVSS 4.3 · Published 2026-09-28

Eleveo Call Recording Software, used to manage and record phone calls in business environments, contains an LDAP injection vulnerability in its user management component. An attacker can remotely manipulate the username field during user addition to inject LDAP commands, potentially bypassing authentication, extracting sensitive directory data, or modifying directory contents without proper authorization.

Technologies: Eleveo Call Recording Software. Vendors: Eleveo.

Quick answers

Is CVE-2026-101145 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101145 being exploited in the wild.
How severe is CVE-2026-101145?: Medium severity, with a CVSS score of 4.3, published 28 September 2026.
Which products and versions are affected?: Eleveo Call Recording Software 9.7.0.
Is there a fix for CVE-2026-101145?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-101145 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-101145?: Check whether you run Eleveo Call Recording Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an LDAP injection in the /callrec/userAddAction.do endpoint of the User Management component, where the Username parameter is not properly sanitized before being used in LDAP queries. The attack is remotely exploitable with no authentication required and has a known public proof-of-concept. This allows an unauthenticated attacker to inject arbitrary LDAP filter syntax to manipulate directory lookups or modify user records.

Affected products

Eleveo Call Recording Software 9.7.0

Timeline

2026-09-28: disclosed
other: Vendor contacted early but did not respond

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.