CVE-2026-66088
Apereo Foundation openEQUELLA
- Apereo Foundation openEQUELLA
- Critical
- CVSS 9.4
- Fixed version listed
Summary
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables.
From the CVE record.
Read the original description
CVE record
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.
What to do
Fixed version listed
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| Apereo Foundation openEQUELLA | before 2026.1 | 2026.1 |
Advisories and fixes
- Vendor advisory github.com
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.4 (v4.0, scored by MON-CSIRT)
- CISA's SSVC decision points
- Exploitation: none. Automatable: no. Technical impact: total. As of Oct 29, 2026.
- Weakness
- CWE-78: Improper neutralization of special elements used in an OS command ('OS command injection'); CWE-749: Exposed dangerous method or function
- Vendor
- Apereo Foundation, openEQUELLA
Timeline
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.