CVE-2026-62764

MediumCVSS 6.5

Published: 17/07/2026(UTC)Updated: 11/08/2026(UTC)Translated: 18/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

38th percentile - higher than 38% of all known CVEs

Summary

In Apache Accumulo 2.1.4 and 2.1.5, an authenticated low-privileged user without system permissions can remotely issue a command to gracefully shutdown system components (compaction-coordinator, compactor, gc, manager, monitor, tserver, sserver), leading to a denial of service.

Risk Assessment

An attacker can deliberately shut down critical system components, causing service disruption and potential data availability loss.

Recommendation

Upgrade Apache Accumulo to version 2.1.6 immediately, which fixes this vulnerability.

Other vulnerabilities in Apache Accumulo

CVE-2023-34340Critical
Apache Accumulo 2.1.0 has an improper authentication vulnerability that may allow successful authentication with invalid credentials. Users are advised to upgrade to 2.1.1.

Original NVD description (English source)

Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo. An authenticated, but low-privileged user without system permissions may issue a remote command to gracefully shutdown system components (compaction-coordinator, compactor, gc, manager, monitor, tserver, or sserver), leading to a denial of service. This issue affects Apache Accumulo 2.1.4 and 2.1.5. Users are recommended to upgrade to version 2.1.6, which fixes the issue.