{"schema_version":"1","data":[{"id":5259,"advisory_id":"960f26a9-8538-4299-a69f-71d2da5d582b","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92142","source_published_at":"2026-09-29T08:40:07.961+00:00","published_at":"2026-10-24T22:05:20.836558+00:00","extraction_method":"structured","technologies":["apache-karaf","core-cve"],"cve_ids":["CVE-2026-92142"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Apache Karaf: Authorization bypass in JMX MBean lifecycle operations","summary":"Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked over the remote JMX connector (RMI registry/server, enabled by default on ports 1099 and 44444). The guard is implemented as a java.lang.reflect.Proxy around the MBeanServer, and only forwards a fixed list of operation names to the RBAC check, defined in MBeanInvocationHandler#guarded: private final List guarded = Collections.unmodifiableList( Arrays.asList(\"invoke\", \"getAttribute\", \"getAttributes\", \"setAttribute\", \"setAttributes\")); The MBean lifecycle operations MBeanServer#createMBean, #registerMBean and #unregisterMBean are not in this list. Calls to these methods are forwarded directly to the underlying MBeanServer with no role check at all, regardless of the roles configured in etc/jmx.acl.*.cfg. As a result, any user who can authenticate to the JMX endpoint, including a user holding only the least-privileged \"viewer\" role, can call createMBean() to instantiate an arbitrary class as a MBean, and unregisterMBean() to remove it again afterwards, with no authorization check and no audit log entry (logging in KarafMBeanServerGuard only occurs on the RBAC-denial path, which this bypass never reaches). This is significant because javax.management.loading.MLet, a standard JDK MBean, can be instantiated this way. MLet acts as a remote classloader: its getMBeansFromURL(URL) operation fetches an MLet text file from an attacker-contro","evidence":"cve:CVE-2026-92142","products":[{"name":{"value":"Apache Karaf","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-92142","aliases":["CVE-2026-92142"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"important"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Karaf","versions":[{"status":"affected","version":"0","lessThan":"4.4.12","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-01T14:24:03.845Z","provider":"cve","references":["https://karaf.apache.org/security/cve-2026-92142.txt"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/28/11"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-29T09:15:50.700Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-92142","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T14:23:22.077130Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T14:24:03.845Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-09-29T08:40:07.961Z"}}},"related_cves":[{"value":"CVE-2026-92142","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}},{"id":5255,"advisory_id":"77661844-2cde-4808-9588-0e9b9b3dec4c","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91085","source_published_at":"2026-09-29T08:39:33.209+00:00","published_at":"2026-10-24T22:05:19.626015+00:00","extraction_method":"structured","technologies":["apache-karaf","core-cve"],"cve_ids":["CVE-2026-91085"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Apache Karaf: config:install missing ACL entry allows privilege escalation to admin","summary":"Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl..cfg). SecuredSessionFactoryImpl.checkSecurity() resolves the roles required for an invocation and, when no ACL rule matches the command, fails open: ACLConfigurationParser.Specificity.NO_MATCH sets passCheck = true. The safety valve for this, karaf.secured.command.compulsory.roles, ships commented out in etc/system.properties, so an unmatched command is allowed for any authenticated user. The shipped org.apache.karaf.command.acl.config ACL (assemblies/features/standard/src/main/feature/feature.xml, mirrored into instance/.../etc/org.apache.karaf.command.acl.config.cfg) has no install entry. It restricts delete to admin, restricts edit/property-*/update on the jmx.acl.*, org.apache.karaf.command.acl.* and org.apache.karaf.service.acl.* PIDs to admin, and allows manager for everything else, but config:install was simply unmatched, and therefore allowed for any authenticated user, including one holding only the viewer role. config:install fetches url and writes it into ${karaf.etc} as finalname. It calls PathUtils.checkWithin() to block .. traversal outside karaf.etc, but that folder holds every security-relevant file Karaf ships: users.properties, keys.properties, host.key, and all org.apache.karaf.*.acl.* files, including the very ACL file that (mis)governs this command. With -o/--override, an existing file is overwritten with attacker-controlled bytes ","evidence":"cve:CVE-2026-91085","products":[{"name":{"value":"Apache Karaf","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-91085","aliases":["CVE-2026-91085"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"moderate"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Karaf","versions":[{"status":"affected","version":"0","lessThan":"4.4.12","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-01T14:18:12.957Z","provider":"cve","references":["https://karaf.apache.org/security/cve-2026-91085.txt"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/28/10"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-29T09:15:47.789Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-91085","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T14:17:41.304608Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T14:18:12.957Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-09-29T08:39:33.209Z"}}},"related_cves":[{"value":"CVE-2026-91085","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}},{"id":5238,"advisory_id":"eb28ef5c-9d1c-4313-a2c7-dbc4d84c2194","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91048","source_published_at":"2026-09-29T08:34:47.193+00:00","published_at":"2026-10-24T22:05:10.26932+00:00","extraction_method":"structured","technologies":["apache-karaf","core-cve"],"cve_ids":["CVE-2026-91048"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create","summary":"The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no matching ACL rule as allowed, so any authenticated shell session (including one holding only the viewer role) could run every jdbc:* command. jdbc:ds-create stores a fully attacker-controlled JDBC URL into a pax-jdbc-config factory Configuration with no validation. pax-jdbc-config reactively turns that into a live DataSource. Several JDBC drivers run code or SQL at connection time based on URL parameters (e.g. H2 INIT=RUNSCRIPT), so a viewer-level shell user could reach arbitrary code execution, bypassing the admin-role gate that already protects shell:exec. This is a privilege-escalation-to-RCE chain, not merely an \"admin misconfiguration\". The same applies to jms:* shell commands.","evidence":"cve:CVE-2026-91048","products":[{"name":{"value":"Apache Karaf","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-91048","aliases":["CVE-2026-91048"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"moderate"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Karaf","versions":[{"status":"affected","version":"0","lessThan":"4.4.12","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-01T14:13:30.717Z","provider":"cve","references":["https://lists.apache.org/thread/ph3867mxh2tft75w0o1hpn10f5mbmw32"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/28/9"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-29T09:15:44.666Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-91048","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T14:13:10.417139Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T14:13:30.717Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-09-29T08:34:47.193Z"}}},"related_cves":[{"value":"CVE-2026-91048","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}},{"id":5237,"advisory_id":"fc5161e8-8a0a-428c-b0e9-016ff2a7d03c","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91012","source_published_at":"2026-09-29T08:34:11.409+00:00","published_at":"2026-10-24T22:05:09.454853+00:00","extraction_method":"structured","technologies":["apache-karaf","core-cve"],"cve_ids":["CVE-2026-91012"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation","summary":"org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the \"config\" MBean and the config:* shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside ${karaf.etc}: * if the submitted property map contains a felix.fileinstall.filename entry, that value is turned directly into a File (getCfgFileFromProperty), so it can point to any absolute path the Karaf process can write to; * otherwise the configuration PID is concatenated verbatim into the target file name (generateConfigFilename(): new File(karaf.etc, pid + \".cfg\")), so a PID containing \"..\" segments resolves outside ${karaf.etc}. createFactoryConfiguration() has the same issue via the factory PID/alias. Both code paths are reachable by any caller holding the \"manager\" role under Karaf's shipped command/JMX ACL (org.apache.karaf.command.acl.conf.cfg: \"update = manager\"). Such a user can therefore write attacker-controlled content to any file the Karaf process can write, including files the same ACL otherwise reserves to \"admin\" (etc/users.properties, etc/*.acl.*.cfg, etc/org.apache.karaf.management.cfg, and similar), allowing a manager-role user to grant themselves the admin role or otherwise take over the container. ConfigMBeanImpl.install() and the config:install shell command already guarded the equivalent risk on their own code path with a finalname.contains(\"..\") string check, but that check does not stop a","evidence":"cve:CVE-2026-91012","products":[{"name":{"value":"Apache Karaf","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-91012","aliases":["CVE-2026-91012"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"important"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Karaf","versions":[{"status":"affected","version":"0","lessThan":"4.4.12","versionType":"semver"}],"packageName":"org.apache.karaf.config.core.impl","defaultStatus":"unaffected"}],"modified":"2026-10-01T14:10:47.838Z","provider":"cve","references":["https://lists.apache.org/thread/op8trtz1qxkdwj2rjozhd9yt2yd6nhw4"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/28/8"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-29T09:15:41.656Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-91012","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T14:10:12.183455Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T14:10:47.838Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-09-29T08:34:11.409Z"}}},"related_cves":[{"value":"CVE-2026-91012","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}},{"id":4874,"advisory_id":"f5c32784-9cbe-414f-b26e-5622bd7331f0","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-90979","source_published_at":"2026-09-28T09:34:33.253+00:00","published_at":"2026-10-24T21:59:07.030198+00:00","extraction_method":"structured","technologies":["apache-karaf","core-cve"],"cve_ids":["CVE-2026-90979"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Apache Karaf: LDAP filter injection in JAAS LDAP login modules","summary":"LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn (drawn from the login name, the resolved user DN, and its fully qualified namespace form) into administrator-configured filter templates (userFilter, roleFilter). Before the fix, the only sanitization applied to the substituted value was double backslashed: filter = filter.replaceAll(Pattern.quote(\"%u\"), Matcher.quoteReplacement(user)); filter = filter.replace(\"\\\\\", \"\\\\\\\\\"); This does not escape the other characters RFC 4515 requires escaping in an LDAP search filter: *, (, ), and NUL. A login name containing any of these can change the structure of the resulting filter rather than being matched as a literal value (e.g. a crafted username can turn an equality match into a wildcard match, or close/reopen filter clauses), widening what the search returns and potentially causing a login or role lookup to match an LDAP entry other than the intended one, over-granting roles, and depending on deployment-specific filter templates, potentially affecting which account a login resolved to. It's not exploitable through every entry points: LDAPLoginModule and LDAPPubkeyLoginModule both called Util.doRFC2254Encoding() (correct RFC 4515 escaping) on the login name before handing it to LDAPCache, which masked the missing escaping in LDAPCache for those two call paths. Using LDAPCache directly (bypassing the login modules) does not reproduce ","evidence":"cve:CVE-2026-90979","products":[{"name":{"value":"Apache Karaf","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-90979","aliases":["CVE-2026-90979"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"moderate"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Karaf","versions":[{"status":"affected","version":"0","lessThan":"4.4.12","versionType":"semver"}],"packageName":"org.apache.karaf.jaas.modules.ldap","defaultStatus":"unaffected"}],"modified":"2026-09-30T19:53:57.685Z","provider":"cve","references":["https://karaf.apache.org/security/cve-2026-90979.txt"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/28/2"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-28T13:10:12.005Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-90979","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T19:53:53.546419Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T19:53:57.685Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-09-28T09:34:33.253Z"}}},"related_cves":[{"value":"CVE-2026-90979","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}},{"id":4042,"advisory_id":"d8930fe4-057e-4b47-82ca-b44a1a404da9","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91006","source_published_at":"2026-09-28T10:44:32.652+00:00","published_at":"2026-10-24T21:45:14.558342+00:00","extraction_method":"structured","technologies":["apache-karaf","core-cve"],"cve_ids":["CVE-2026-91006"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)","summary":"Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows). The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value containing shell metacharacters (;, |, `, $(...)) is interpreted by the shell instead of being passed to the JVM as an option, giving arbitrary OS command execution as the Karaf process user. Reachable via the shell commands instance:create, instance:start, instance:restart, instance:change-opts, and the equivalent InstanceMBean JMX operations (createInstance, startInstance, changeJavaOpts, cloneInstance). Mitigation * Set karaf.secured.command.compulsory.roles=admin in etc/system.properties to close the fail-open gap for all unconfigured command scopes. * Restrict which principals can reach instance:* commands and InstancesMBean via etc/users.properties role assignments. * Treat javaOpts passed to instance:create/instance:start/instance:change-opts/InstancesMBean as untrusted input only from fully-trusted operators.","evidence":"cve:CVE-2026-91006","products":[{"name":{"value":"Apache Karaf","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-91006","aliases":["CVE-2026-91006"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"moderate"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Karaf","versions":[{"status":"affected","version":"0","lessThan":"4.4.12","versionType":"semver"}],"packageName":"org.apache.karaf:org.apache.karaf.instance.core","defaultStatus":"unaffected"}],"modified":"2026-09-29T21:03:21.368Z","provider":"cve","references":["https://lists.apache.org/thread/olzy0yjw82b20w59vonfjr1x7v5yzocr"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/28/3"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-28T13:10:12.951Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-91006","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T03:55:20.472246Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T21:03:21.368Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-09-28T10:44:32.652Z"}}},"related_cves":[{"value":"CVE-2026-91006","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}}],"next_after":5259,"next_before":4042}