CVE-2026-75414

CriticalCVSS 9.8

Published: 26/08/2026(UTC)Updated: 03/09/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

38th percentile - higher than 38% of all known CVEs

Summary

In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command execution vulnerability.

Risk Assessment

An attacker can execute arbitrary commands on the server, potentially leading to full system compromise, including data theft or malware installation.

Recommendation

Filter and sanitize user input before passing to JUEL expressions and restrict access to functions that execute these expressions.

Other vulnerabilities in AntFlow

CVE-2026-75415High
AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive information leakage.

Original NVD description (English source)

In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command execution vulnerability.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS