CVE-2026-94114

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-08

Assigner: Apache Software Foundation

Description

Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before 6.13.0. Users are recommended to upgrade to version 6.13.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-08

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-94114

EUVD

EUVD-2026-93970

Affected Vendors & Products

Vendor	Product	Version / Range
Apache	Software	Foundation Apache Commons BCEL 0
Apache	Software	Foundation Apache Commons BCEL 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-386	A constant symbolic reference to an object is used, even though the reference can resolve to a different object over time.

Attack-Flow Graph

Executive Summary

This vulnerability involves Apache Commons BCEL incorrectly caching attacker-controlled classes under their self-declared names without validation. This allows lookups to refer to a different class than intended, potentially leading to security issues.

Detection Guidance

This vulnerability is specific to Apache Commons BCEL versions before 6.13.0. Detection involves checking the installed version of Apache Commons BCEL. Use commands like 'find / -name "commons-bcel*.jar" 2>/dev/null' to locate the library and 'jar tf <path-to-jar> | grep -i "version"' to check the version.

Impact Analysis

An attacker could exploit this to bypass security checks or manipulate class lookups, potentially leading to unauthorized access or execution of malicious code. Systems using affected versions before 6.13.0 are at risk.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access or manipulation of cached class objects. The issue enables attackers to substitute classes under attacker-controlled names, which may lead to improper data handling or exposure. However, specific compliance impacts depend on system implementation and usage context.

Mitigation Strategies

Upgrade Apache Commons BCEL to version 6.13.0 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-94114. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70