CVE-2026-67615

Received Received - Intake

Authenticated Remote Code Execution in openEQUELLA via Java Deserialization

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: VulnCheck

Description

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/*. Attackers can bypass the class-name denylist enforced by PluginAwareObjectInputStream by nesting a serialized payload inside a java.security.SignedObject, causing the inner stream to be deserialized by a separate ObjectInputStream that does not apply the denylist, ultimately reaching a JNDI sink and enabling code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-67615

Affected Vendors & Products

Vendor	Product	Version / Range
openequella	openequella	to 2026.1.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

Executive Summary

This is an authenticated remote code execution vulnerability in openEQUELLA before version 2026.1.0. It allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/*. Attackers bypass the class-name denylist by nesting a serialized payload inside a java.security.SignedObject, causing the inner stream to be deserialized without the denylist, reaching a JNDI sink and enabling code execution.

Detection Guidance

Detecting this vulnerability requires checking for the presence of the vulnerable /invoker/* endpoint and analyzing Java deserialization patterns. Inspect HTTP responses for endpoints containing /invoker/ and review logs for JNDI lookup attempts or unusual serialized payloads. Use tools like curl to probe for the endpoint: curl -v http://<target>/invoker/.

Impact Analysis

An attacker with valid credentials could execute arbitrary code on the affected system, potentially leading to full system compromise, data theft, or disruption of services. This could allow unauthorized access to sensitive data or control over the system.

Compliance Impact

This vulnerability could lead to unauthorized access or exfiltration of sensitive data, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately upgrade openEQUELLA to version 2026.1.0 or later to patch the vulnerability. If upgrading is not possible, restrict access to the /invoker/* endpoint via network controls or disable it entirely. Monitor for signs of exploitation such as unexpected JNDI lookups or code execution attempts.

Hi! I’m here to help you understand CVE-2026-67615. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70