Is CVE-2026-47840 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47840 being exploited in the wild.

How severe is CVE-2026-47840?

High severity, with a CVSS score of 7.5, published 9 July 2026.

Which products and versions are affected?

CloudFoundry Foundation UAA prior to v78.13.0; CloudFoundry Foundation Cf-deployment prior to v56.2.0.

Is there a fix for CVE-2026-47840?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-47840 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-47840?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47840: CloudFoundry UAA LDAP hostname verification bypass in StartTLS

CVE-2026-47840 · Severity: high · CVSS 7.5 · Published 2026-07-09

CloudFoundry UAA, an identity management service, contains a security flaw in how it connects to LDAP directories for user authentication. An attacker positioned on the network between these systems can impersonate the directory server to steal administrative credentials and user passwords. This could allow an attacker to gain full administrative control over the CloudFoundry environment and access sensitive user data.

Quick answers

Is CVE-2026-47840 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47840 being exploited in the wild.
How severe is CVE-2026-47840?: High severity, with a CVSS score of 7.5, published 9 July 2026.
Which products and versions are affected?: CloudFoundry Foundation UAA prior to v78.13.0; CloudFoundry Foundation Cf-deployment prior to v56.2.0.
Is there a fix for CVE-2026-47840?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-47840 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-47840?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in CloudFoundry UAA where LDAP StartTLS connections unconditionally disable hostname verification. A network attacker positioned between UAA and the LDAP directory can perform a man-in-the-middle (MitM) attack using any valid certificate from a trusted Certificate Authority (CA), even if it does not match the LDAP server's hostname. This allows the attacker to harvest LDAP bind passwords and end-user credentials during simple-bind authentication. Furthermore, the attacker can return forged LDAP group memberships to grant themselves administrative scopes within the UAA environment. The issue is resolved in UAA v78.13.0 and cf-deployment v56.2.0.

Affected products

CloudFoundry Foundation UAA prior to v78.13.0
CloudFoundry Foundation Cf-deployment prior to v56.2.0

Timeline

2026-07-08: advisory: Initial vulnerability report published by Cloud Foundry Foundation
2026-07-09: disclosed: CVE published to NVD dataset

References

https://www.cloudfoundry.org/blog/cve-2026-47840-ldap-starttls-unconditionally-disables-hostname-verification/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.