CVE-2026-1225
Unknown Unknown - Not Provided
ACE Vulnerability in QOS.CH logback-core Allows Class Instantiation

Publication date: 2026-01-22

Last updated on: 2026-01-22

Assigner: Switzerland Government Common Vulnerability Program

Description
ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file. The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-22
Last Modified
2026-01-22
Generated
2026-05-07
AI Q&A
2026-01-22
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
qos.ch logback-core to 1.5.24 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is an ACE (Arbitrary Code Execution) issue in the configuration file processing of QOS.CH logback-core up to version 1.5.24 used in Java applications. It allows an attacker who has write access to an existing logback configuration file to instantiate classes that are already present on the application's class path. However, the instantiated malicious class is likely discarded immediately without further effect.


How can this vulnerability impact me? :

If an attacker can write to a logback configuration file, they can instantiate potentially malicious classes present on the class path, which could lead to arbitrary code execution. However, since the instantiated class is likely discarded immediately, the practical impact is limited. The vulnerability requires high privileges (write access to configuration files) and the presence of malicious classes on the class path.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, ensure that untrusted users do not have write access to logback configuration files. Restrict permissions on these configuration files to prevent unauthorized modifications. Additionally, review and secure the class-path to avoid the presence of potentially malicious classes that could be instantiated.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart