CVE-2025-26074

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Jun 30, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-26088.8A vulnerability classified as critical has been found in PHPGurukul Banquet Booking System 1.2. This affects an unknown part of the file /adCVE-2025-260867.5An unauthenticated blind SQL injection vulnerability exists in RSI Queue Management System v3.0 within the TaskID parameter of the get requeCVE-2025-26096.1Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticatCVE-2025-260914.6A Cross Site Scripting (XSS) vulnerability exists in TeamPasswordManager v12.162.284 and before that could allow a remote attacker to executCVE-2025-26105.4Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling (Alarm Module modules) allows authCVE-2025-26119.3The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a sCVE-2025-261257.3An exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter v12.1.0 allows attackers to arbitrarily delete files and escalate priCVE-2025-261275.0A stored cross-site scripting (XSS) vulnerability in the Send for Approval function of FileCloud v23.241.2 allows attackers to execute arbitCVE-2025-26134.4The Login Manager – Design Login Page, View Login Activity, Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site ScrCVE-2025-261369.8A SQL injection vulnerability exists in mysiteforme versions prior to 2025.01.1.CVE-2025-261377.5Systemic Risk Value <=2.8.0 is vulnerable to Local File Inclusion via /GetFile.aspx?ReportUrl=. An unauthenticated attacker can exploit thisCVE-2025-261386.5Systemic Risk Value <=2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.aspx?ID=. Uploaded file
CVE-2025-26074: Critical severity, CVSS 9.8 | Vulnix