Dashboard / CVE-2026-66088

CVE-2026-66088

CRITICAL
INFO Priority: 0.06 BB Relevance: 69/100
Published: 2026-10-29 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: High
VI: High
VA: High

Description

In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.

Weakness Classification (2)

Affected Software (4)

VendorProductVersion
Apereo Foundation openEQUELLA 0 < 2026.1
Apereo Foundation openEQUELLA 0 < 2026.1
Apereo Foundation openEQUELLA 0 < 2026.1
Apereo Foundation openEQUELLA 0 < 2026.1

References & Advisories (2)

Bug Bounty Relevance

69 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

9.4 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L

EPSS — Exploitation Probability

0.69%
Raw Score 0.006850
Percentile 52.5%
Date 2026-10-29

Intelligence Sources

mitre ref →
nvd ref →

External Links