CVE-2026-62392

CriticalCVSS 9.8

Published: 14/07/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

1.83%

76th percentile - higher than 76% of all known CVEs

Summary

An OS Command Injection vulnerability has been found in Apache Kylin. Improper neutralization of special elements in job configuration parameters may allow an attacker to execute arbitrary commands via the backend API. Affects versions 4 through 5.0.3.

Risk Assessment

An attacker can remotely execute arbitrary system commands on the server, leading to full system compromise, data theft, or service disruption.

Recommendation

Upgrade Apache Kylin to version 5.0.4 immediately, which contains the fix for this vulnerability.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API may bring job config parameters to OS command line. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which fixes the issue.