CVE-2026-67961
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the sandbox mechanism of the Invoke script execution.
Risk Assessment
A local attacker could gain full control over the system, potentially leading to compromise of data integrity and confidentiality, and system takeover.
Recommendation
It is recommended to update O2OA to the latest version that includes security fixes and restrict local access to the system.
Other vulnerabilities in O2OA
See all- CVE-2026-97179Medium
A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/x_base_core_project/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java of the Cipher Connection Handler component. Manipulation of the fileUrl argument leads to information disclosure. The attack can be launched remotely, and the exploit has been publicly disclosed and may be used. The vendor was contacted but did not respond.
- CVE-2022-22916Critical
O2OA version 6.4.7 contains a remote code execution (RCE) vulnerability via the /x_program_center/jaxrs/invoke endpoint. An attacker can send a specially crafted request to execute arbitrary code on the server.
- CVE-2026-105438Medium
A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /x_general_assemble_control/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- CVE-2026-52370Medium
Reflected XSS vulnerability in the forum posting function of O2OA v10 allows attackers to execute arbitrary JavaScript in the victim's browser context via a crafted URL.
Original NVD description (English source)
An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the the sandbox mechanism of the Invoke script execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS