What’s Vulnerable › Vulnerabilities

CVE-2016-6500

• Severity: high (CVSS 8.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-02-03 · updated 2026-06-17
• Weakness: CWE-20

Description

Unspecified methods in the RACF Connector component before 1.1.1.0 in ForgeRock OpenIDM and OpenICF improperly call the SearchControls constructor with returnObjFlag set to true, which allows remote attackers to execute arbitrary code via a crafted serialized Java object, aka LDAP entry poisoning.

Affected products

• ForgeRock Racf Connector: through 1.1.0.0

References

• https://backstage.forgerock.com/knowledge/kb/article/a96963547
• https://backstage.forgerock.com/knowledge/kb/article/a96963547

Get alerted when CVE-2016-6500 or the next vulnerability affects your stack