CVE-2026-44416

Katalog CVE

CVSS 9.8 · Critical EPSS 1,2%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada apache ranger. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

Rincian

Terbit di NVD

10 Agustus 2026

Terakhir diubah

17 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 68,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/2gqssqhwkzbpd8jx8q6986cwldr7qkdn mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/08/09/6 mailing list · advisory pihak ketiga