CVE-2026-40920: apache software foundation apache ranger Improper Input Validation
CVSS: 9.8v3.1CriticalAnalyzed
Published 10-08-2026Last modified 12-08-2026
Vulnerability summary
CVE-2026-40920 is a critical (CVSS 9.8) Improper Input Validation vulnerability in apache software foundation apache ranger. EPSS estimates a 0.73% chance of exploitation in the next 30 days, higher than 53.4% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
0.73%
0%100%
Low · +0.34 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 10-08-2026PublishedVulnerability first disclosed.
- 12-08-2026Last modifiedVulnerability information updated.
Description
Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVSS metrics
2 scores · 2 sources · 1 versionCritical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 2 agree
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.73%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
+0.34 pp
From 0.39% on 18-09-2026
18-09-202618-10-2026
EPSS score0.73%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected systems
Apache1 product
- ranger< 2.9.0
Apache software foundation1 product
- apache ranger≤ 2.8.0
2 vendors · 2 products