CVE-2025-59059

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2.8.0, which fixes this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Ranger	<= 2.7.0

References

https://lists.apache.org/thread/z47q86rho80390lf2qcmoc2josvs0gtvMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/03/02/5Mailing List, Third Party Advisory

Timeline

Published: Mar 3, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-59069.8A vulnerability classified as critical has been found in code-projects Laundry System 1.0. This affects an unknown part of the file /data/. CVE-2025-590605.3Hostname verification bypass issue in Apache Ranger NiFiRegistryClient is reported in Apache Ranger versions <= 2.7.0. Users are recommende CVE-2025-59078.8A vulnerability classified as critical was found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. This vulnerability affects unknown code o CVE-2025-59088.8A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. This issue affects some CVE-2025-590888.6If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV CVE-2025-590895.9If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit CVE-2025-59098.8A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. Affected is an unknown functi CVE-2025-590909.3On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. There CVE-2025-590919.3Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and CVE-2025-590928.7An RPC service, which is part of exos 9300, is reachable on port 4000, run by the process FSMobilePhoneInterface.exe. This service is used f CVE-2025-590938.5Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server. The password is derived from CVE-2025-590948.4A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application (d9sysdef.exe). Within th