Executive Summary

CVE-2026-4564 is a critical Remote Code Execution (RCE) vulnerability in the RuoYi Management System, specifically affecting versions up to 4.8.2. The flaw exists in the Quartz scheduled task management module, accessible via the /monitor/job endpoint.

The vulnerability arises because the system fails to properly sanitize and validate the invokeTarget parameter, which specifies the method to be invoked by a scheduled task. An attacker with administrative credentials can create or edit scheduled tasks with a malicious invokeTarget payload, causing arbitrary code to execute on the server when the task triggers.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with administrative access to execute arbitrary system commands remotely on the affected server.

• Full system compromise, including access to sensitive data.
• Potential lateral movement within internal networks.
• Installation of persistent backdoors, enabling long-term unauthorized access.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'Detection of CVE-2026-4564 involves verifying if the RuoYi Management System is running a vulnerable version (4.8.2 or below) and checking for exploitation attempts targeting the Quartz scheduler endpoints.'}, {'type': 'paragraph', 'content': 'A Nuclei template has been created to automate detection by simulating login, accessing the job management page, and submitting a crafted scheduled task with a malicious invokeTarget parameter. The template checks for response keywords like "success" or "操作成功" (operation successful) to confirm vulnerability.'}, {'type': 'paragraph', 'content': 'To manually detect suspicious activity, monitor HTTP POST requests to the following endpoints:'}, {'type': 'list_item', 'content': 'POST /monitor/job/add'}, {'type': 'list_item', 'content': 'POST /monitor/job/edit'}, {'type': 'paragraph', 'content': 'Look for unusual or unexpected values in the invokeTarget parameter, which may contain malicious expressions.'}, {'type': 'paragraph', 'content': 'Suggested commands for detection include using network monitoring tools or web server logs to filter requests:'}, {'type': 'list_item', 'content': "grep -i 'POST /monitor/job' /var/log/nginx/access.log"}, {'type': 'list_item', 'content': "tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'"}, {'type': 'list_item', 'content': 'Use the Nuclei scanner with the provided template from https://github.com/M0onc/RuoYi-Quartz-RCE to automate detection.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps for CVE-2026-4564 include:

• Upgrade the RuoYi Management System to the latest version beyond 4.8.2 where the vulnerability is fixed.
• Disable the Quartz scheduled task feature if it is not required in your environment.
• Implement strict input validation and sanitization on the invokeTarget parameter to prevent code injection.
• Avoid dynamic method invocation and use parameterized queries where possible.
• Enforce strong authentication and least privilege access controls to limit administrative access.
• Enable logging and monitoring to detect suspicious activities related to scheduled task management.
• Deploy Web Application Firewall (WAF) rules to block malicious requests targeting the vulnerable endpoints.
• Use network segmentation to isolate the management system from other critical network resources.

Useful 0 Not Useful 0