CVE-2026-67919

Received Received - Intake

Remote Code Execution in Halo CMS

Publication date: 2026-08-17

Last updated on: 2026-08-18

Assigner: MITRE

Description

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-18

Generated

2026-09-07

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-05

NVD

CVE-2026-67919

EUVD

EUVD-2026-60544

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability in Halo version 2.25.4 allows a remote attacker to execute arbitrary code. The issue is located in the PluginEndpoint.java file, specifically in the installFromUri method, and involves the DefaultPluginApplicationContextFactory components.

Detection Guidance

To detect CVE-2026-67919, monitor network traffic for POST requests to the vulnerable endpoint /apis/api.console.halo.run/v1alpha1/plugins/-/install-from-uri. Check server logs for unexpected plugin installations or JAR file downloads from untrusted sources. Use tools like Wireshark or tcpdump to inspect HTTP traffic for malicious plugin URIs.

Impact Analysis

An attacker could exploit this flaw to run malicious code on your system remotely. This could lead to unauthorized access, data theft, or further compromise of your environment if you are using Halo 2.25.4.

Compliance Impact

This vulnerability allows remote code execution, which could lead to unauthorized access to sensitive data. For GDPR, this may result in data breaches requiring notification under Article 33. For HIPAA, it could compromise protected health information, violating the Security Rule. The high CVSS score indicates severe impact on confidentiality, integrity, and availability.

Mitigation Strategies

Immediately update Halo to a patched version beyond 2.25.4 to address the arbitrary code execution flaw in PluginEndpoint.java and related components.

Hi! I’m here to help you understand CVE-2026-67919. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70