CVE-2026-66088: falha crítica em Apereo Foundation openEQUELLA
Unrestricted Command Execution via system.execute
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.4epss 0.7%
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L
Produtos afetados
Apereo Foundation · openEQUELLACVEs relacionadas — Apereo Foundation openEQUELLA
No mesmo produto, das mais perigosas para as menos.
CVE-2026-67615HIGHopenEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP InvokerEPSS 0.5%CVE-2026-66091MEDIUMUnauthenticated IDOR Enables Disclosure of Other Users’ last-known detailsEPSS 0.4%CVE-2026-66092MEDIUMStored XSS in pre-login notice via reachable legacy logon routeEPSS 0.3%CVE-2026-16889MEDIUMStored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application OriginEPSS 0.3%CVE-2026-66090HIGHXML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File ReadEPSS 0.3%CVE-2026-66089MEDIUMXML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity ExpansionEPSS 0.3%