# CVE-2026-75879: IBM Content Navigator LDAP injection

Source: https://junglewise.ai/threats/cve-2026-75879-ibm-content-navigator-3-0-15-0-26-0-0-0-3-1-0-0-and-3-2-0-0-is  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-75879 · Severity: medium · CVSS 4.3 · Published 2026-11-08

IBM Content Navigator is a content management system that stores and retrieves enterprise documents. An authenticated attacker can exploit an LDAP injection flaw to enumerate users and other sensitive information stored in the LDAP directory that the application relies on for authentication. This allows an insider or compromised account to discover organizational structure and user details without proper authorization.

Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-75879 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75879 being exploited in the wild.

**How severe is CVE-2026-75879?** Medium severity, with a CVSS score of 4.3, published 8 November 2026.

**Which products and versions are affected?** IBM Content Navigator 3.0.15.0, 26.0.0.0, 3.1.0.0, 3.2.0.0.

**Is there a fix for CVE-2026-75879?** Yes: fixed in Content Navigator 3.0.15-IF011, 26.0.0-IF004, 3.1.0-IF013, 3.2.0-IF008. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75879 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-75879?** Check whether you run IBM Content Navigator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Content Navigator 3.0.15-IF011, 26.0.0-IF004, 3.1.0-IF013, 3.2.0-IF008

## Technical details

LDAP injection occurs in IBM Content Navigator when user input is not properly sanitized before being used in LDAP queries. A remote authenticated attacker can craft a specially crafted request containing LDAP metacharacters to modify the query logic and enumerate directory information. This requires valid authentication credentials but does not enable data modification or system compromise beyond information disclosure.

## Affected products

- IBM Content Navigator 3.0.15.0, 26.0.0.0, 3.1.0.0, 3.2.0.0

## Timeline

- 2026-11-02: disclosed

## References

- [https://www.ibm.com/support/pages/node/7295227](https://www.ibm.com/support/pages/node/7295227)

## Related threats

- [IBM Content Navigator 3.0.15, 3.1.0, and 3.2.0 is vulnerable to cross-site scripting. This vulnerability allows an…](https://junglewise.ai/threats/cve-2026-1243-ibm-content-navigator-3-0-15-3-1-0-and-3-2-0-is-vulnerable-to)