CVE-2022-22916

CriticalCVSS 9.8

Published: 17/02/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

38.39%

98th percentile - higher than 98% of all known CVEs

Summary

O2OA version 6.4.7 contains a remote code execution (RCE) vulnerability via the /x_program_center/jaxrs/invoke endpoint. An attacker can send a specially crafted request to execute arbitrary code on the server.

Risk Assessment

The risk for the organization includes full server compromise, data theft, or service disruption.

Recommendation

It is recommended to immediately update O2OA to the latest version that fixes this vulnerability and restrict access to the /x_program_center/jaxrs/invoke endpoint to trusted networks only.

Other vulnerabilities in O2OA

See all

CVE-2026-67961High
An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the sandbox mechanism of the Invoke script execution.
CVE-2026-52370Medium
Reflected XSS vulnerability in the forum posting function of O2OA v10 allows attackers to execute arbitrary JavaScript in the victim's browser context via a crafted URL.

Original NVD description (English source)

O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke.