CVE-2026-94109High· 8.0▾ MidnightPoC availableopenEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 44 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.9%
8.8 → 8
Last analysed / modified upstream
Exploit / PoC code exists
openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the RemotePortletService invoker endpoint. The markup field from stored portlet configuration is passed directly to custFactory.createResult() without a TemplateClassResolver restriction or FreeMarker sandboxing in BasicConfiguration, leaving built-ins such as ?new and freemarker.template.utility.Execute available, causing the payload to execute in the application server process context when any user renders a dashboard containing the affected portlet.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-67615High· 8.8openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/…
CVE-2026-16889Medium· 4.8Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin
CVE-2026-66088Critical· 9.4Unrestricted Command Execution via system.execute
CVE-2026-66089Medium· 6.1XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion
CVE-2026-66091Medium· 6.9Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details
CVE-2026-66092Medium· 4.8Stored XSS in pre-login notice via reachable legacy logon route