7.5

CVE-2019-10086: apache apache commons beanutils Deserialization of Untrusted Data

Modified
AliasesMGASA-2019-0399SUSE-SU-2019:2244-1SUSE-SU-2019:2245-1
Published 20-08-2019Last modified 08-10-2026

Vulnerability summary

CVE-2019-10086 is a high (CVSS 7.5) Deserialization of Untrusted Data vulnerability in apache apache commons beanutils. EPSS estimates a 29.08% chance of exploitation in the next 30 days, higher than 98.1% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.3 (NVD); no exploitation reported by the 5 checked sources; EPSS 29% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v2.0 (NVD)
EPSS score
29.08%
0%100%
High · +0.70 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 4
OPENSUSE-SU-2024:10617-1RHSA-2020:0804RHSA-2020:0805RHSA-2020:0806RHSA-2020:1308RHSA-2020:1454

Timeline

  1. 20-08-2019
    PublishedVulnerability first disclosed.
  2. 08-10-2026
    Last modifiedVulnerability information updated.

Description

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

CVSS metrics

9 scores · 7 sources · 3 versions

EPSS trend

Probability

29.08%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

Increase +0.70 pp

From 28.38% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard63 products
  • eco-java-gradle-1.11All versions (No fix recorded)
  • hadoop-fips-3.3.6< 3.3.6-r15
  • hadoop-fips-3.4.2All versions (No fix recorded)
  • hadoop-fips-3.5< 3.5.0-r12
  • trino< 439-r0
Wolfi59 products
  • trino< 439-r0
  • trino-config< 439-r0
  • trino-oci-entrypoint< 439-r0
  • trino-plugin-ai-functions< 439-r0
  • trino-plugin-bigquery< 439-r0
Oracle48 products
Redhat17 products
Apache3 products
Opensuse3 products
  • leapEOL15.0 | 15.1
  • apache-commons-beanutils&distro=openSUSE Leap 15.0< 1.9.2-lp151.3.3.1
  • apache-commons-beanutils&distro=openSUSE Leap 15.1< 1.9.2-lp151.3.3.1
Debian2 products
  • commons-beanutils< 1.9.4-1 | < 1.9.2-1+deb8u1
  • debian_linuxEOL8.0
Mageia2 products
  • apache-commons-beanutils< 1.9.4-1.mga7
  • apache-commons-collections< 3.2.2-7.1.mga7
Commons-beanutils1 product
  • commons-beanutils< 1.9.4
Fedoraproject1 product
Ubuntu1 product
  • commons-beanutils< 1.9.1-1ubuntu0.1~esm1 | < 1.9.2-3ubuntu0.1~esm1 | < 1.9.3-1ubuntu0.1~esm1

11 vendors · 200 products · Showing 200 of 231

References

135 links
Show all 100 references

Showing 100 of 135.