CVE-2026-67615

HighCVSS 8.8

Published: 22/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.00%

61th percentile - higher than 61% of all known CVEs

Summary

Risk Assessment

An attacker could execute arbitrary code on the server, potentially leading to full system compromise, data theft, or disruption.

Recommendation

Upgrade openEQUELLA to version 2026.1.0 or later.

Other vulnerabilities in openEQUELLA

CVE-2026-94109High
openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the RemotePortletService invoker endpoint. The markup field from stored portlet configuration is passed directly to custFactory.createResult() without a TemplateClassResolver restriction or FreeMarker sandboxing in BasicConfiguration, leaving built-ins such as ?new and freemarker.template.utility.Execute available, causing the payload to execute in the application server process context when any user renders a dashboard containing the affected portlet.

Original NVD description (English source)

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/*. Attackers can bypass the class-name denylist enforced by PluginAwareObjectInputStream by nesting a serialized payload inside a java.security.SignedObject, causing the inner stream to be deserialized by a separate ObjectInputStream that does not apply the denylist, ultimately reaching a JNDI sink and enabling code execution.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS