{"id":"CVE-2026-67615","title":"openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/…","summary":"openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-184","CWE-502"],"vendor":"Apereo Foundation","product":"openEQUELLA","affected":["openEQUELLA < 2026.1.0"],"published":"2026-09-22","updated":"2026-09-23","sourceUpdated":"2026-09-23T15:17:16.213","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-67615","references":[{"url":"https://blog.evan.lat/posts/openeq","label":"disclosure@vulncheck.com"},{"url":"https://github.com/openequella/openEQUELLA/releases/tag/2026.1.0","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openequella-authenticated-rce-via-java-deserialization-in-http-invoker","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-23T15:07:33.653890Z"},"epss":0.00836,"epssPercentile":0.56226,"ingestedAt":"2026-09-22T21:11:40.324Z","slug":"CVE-2026-67615","body":"## Overview\n\nopenEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/*. Attackers can bypass the class-name denylist enforced by PluginAwareObjectInputStream by nesting a serialized payload inside a java.security.SignedObject, causing the inner stream to be deserialized by a separate ObjectInputStream that does not apply the denylist, ultimately reaching a JNDI sink and enabling code execution.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":61,"depthScoreParts":{"impact":48.4,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":209713,"id":"CVE-2026-67615","ts":1790177219209,"field":"exploit_available","old":"false","new":"true"}]}