HIGH 8.7 NVD
CVE-2026-67615
openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code
openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/*. Attackers can bypass the class-name denylist enforced by PluginAwareObjectInputStream by nesting a serialized payload inside a java.security.SignedObject, causing the inner stream to be deserialized by a separate ObjectInputStream that does not apply the denylist, ultimately reaching a JNDI sink and enabling code execution.
References
- https://github.com/openequella/openEQUELLA/releases/tag/2026.1.0
- https://www.vulncheck.com/advisories/openequella-authenticated-rce-via-java-deserializatio
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-09-22 via NVD.
vulnfeed aggregates 13417 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.