CVE-2026-28672

CriticalCVSS 9.8

Published: 10/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.01%

60th percentile - higher than 60% of all known CVEs

Summary

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger, affecting versions from 0.6 through 2.8.

Risk Assessment

An attacker can execute arbitrary system commands on the server, potentially leading to full system compromise.

Recommendation

Check for available updates and apply security patches for Apache Ranger.

Original NVD description (English source)

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8.