CVE-2026-67615

HighCVSS 8.8/10Last modified Oct 29, 2026

Description

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/*. Attackers can bypass the class-name denylist enforced by PluginAwareObjectInputStream by nesting a serialized payload inside a java.security.SignedObject, causing the inner stream to be deserialized by a separate ObjectInputStream that does not apply the denylist, ultimately reaching a JNDI sink and enabling code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-184 CWE-502

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Apereo Foundation	openEQUELLA	< 2026.1.0

References

Timeline

Published: Sep 22, 2026
Last modified: Oct 29, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-676164.3Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any a CVE-2026-676174.8Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authentic CVE-2026-676186.5marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embed CVE-2026-67626.3Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thund CVE-2026-676207.7Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAU CVE-2026-676217.6Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized doc CVE-2026-676229.9Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authentica CVE-2026-676238.8Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a CVE-2026-676246.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-676258.5Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-676266.5Uncontrolled resource consumption in SQL Server allows an authorized attacker to deny service over a network.CVE-2026-676284.9Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.