9.3

CVE-2020-26217: apache activemq OS Command Injection

CVSS: 9.3v2.0HighAnalyzed
AliasesRHSA-2021:0162UBUNTU-CVE-2020-26217DEBIAN-CVE-2020-26217
Published 16-11-2020Last modified 07-10-2026
Open JSON

Vulnerability summary

CVE-2020-26217 is a high (CVSS 9.3) OS Command Injection vulnerability in apache activemq. EPSS estimates a 85.00% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.3/10
010
High · v2.0 (NVD)
EPSS score
85.00%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 7 · Related 7
OPENSUSE-SU-2021:0140-1OPENSUSE-SU-2024:10592-1SUSE-SU-2021:0176-1SUSE-SU-2021:0906-1USN-4714-1USN-4943-1

Timeline

  1. 16-11-2020
    PublishedVulnerability first disclosed.
  2. 07-10-2026
    Last modifiedVulnerability information updated.

Description

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.

CVSS metrics

8 scores · 7 sources · 2 versions

EPSS trend

Probability

85.00%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 85.00% on 19-09-2026

19-09-202619-10-2026
EPSS score
85.00%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (x-stream.github.io)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Oracle11 products
Chainguard2 products
  • hadoop-fips-3.3.6All versions (No fix recorded)
  • hadoop-fips-3.4.2All versions (No fix recorded)
Debian2 products
  • libxstream-java< 1.4.14-1 | < 1.4.11.1-1+deb10u1 | < 1.4.9-2+deb9u1
  • debian_linuxEOL9.0 | 10.0
Redhat2 products
  • xstream< 0:1.3.1-12.el7_9
  • xstream-javadoc< 0:1.3.1-12.el7_9
Apache1 product
Com.thoughtworks.xstream1 product
  • xstream< 1.4.14-java7
Netapp1 product
Ubuntu1 product
  • libxstream-java< 1.4.7-1ubuntu0.1+esm2 | < 1.4.8-1ubuntu0.1+esm3 | < 1.4.11.1-1~18.04.1 | < 1.4.11.1-1ubuntu0.1
X-stream1 product
Xstream1 product

10 vendors · 23 products

References

33 links
Show all 33 references