CVE-2026-66088Critical· 9.4▾ MidnightIn openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 51.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.7%
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.
openEQUELLA < 2026.1Upgrade to vendor recommended versions
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-16889Medium· 4.8Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin
CVE-2026-66089Medium· 6.1XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion
CVE-2026-66091Medium· 6.9Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details
CVE-2026-66092Medium· 4.8Stored XSS in pre-login notice via reachable legacy logon route
CVE-2026-66090High· 7.1XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read
CVE-2026-67615High· 8.8openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/…