CVE-2026-40920

CriticalCVSS 9.8

Published: 10/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

Privilege Escalation via URL Parameter in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0.

Risk Assessment

An attacker can escalate privileges, potentially leading to unauthorized access to sensitive data and functions.

Recommendation

Upgrade Apache Ranger to version 2.9.0 or later immediately.

Original NVD description (English source)

Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.