CVE-2012-5932: NetIQ Privileged User Manager eval injection in ldapagnt.dll

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS 2.0 score of 10 and public exploit references makes this a top remediation priority despite the product being end-of-life.

What it is

NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 contains an eval injection flaw in the ldapagnt_eval function of ldapagnt.dll inside unifid.exe. A crafted application/x-amf request causes attacker-supplied data to be evaluated as Perl code, giving remote code execution on the affected service.

Impact

An unauthenticated remote attacker can execute arbitrary Perl code with the privileges of the unifid.exe service, leading to full compromise of the host and any privileged credentials it manages.

Attack surface

The flaw is reachable over the network through the AMF endpoint handled by unifid.exe; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.

Exploitation

CISA KEV does not list this CVE, but EPSS is high (0.6275, ~99th percentile) and two references are tagged Exploit, indicating public exploit code exists.

What to do

• Upgrade NetIQ Privileged User Manager to 2.3.1 HF2 or later, which the vendor advisory identifies as the fix.
• If immediate upgrade is not possible, restrict network access to the unifid.exe AMF listener to trusted management hosts only.
• Run the service under a least-privilege account and isolate the host from unrelated network segments.
• Monitor vendor advisory 7011385 for any additional guidance or updated builds.

Detection

• Inspect unifid.exe or ldapagnt.dll process logs for unexpected Perl evaluation errors or crashes.
• Alert on application/x-amf requests to the PUM management service from hosts outside the normal administrative subnet.
• Baseline and monitor child processes or command execution spawned by unifid.exe for anomalies.
• Review network flows to the PUM service port for unusual source addresses or request volumes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.