CVE-2026-67615: apereo foundation openequella Incomplete List of Disallowed Inputs

Vulnerability summary

CVE-2026-67615 is a high (CVSS 8.8) Incomplete List of Disallowed Inputs vulnerability in apereo foundation openequella. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 22-09-2026
   PublishedVulnerability first disclosed.
2. 26-09-2026
   Last modifiedVulnerability information updated.

Description

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/*. Attackers can bypass the class-name denylist enforced by PluginAwareObjectInputStream by nesting a serialized payload inside a java.security.SignedObject, causing the inner stream to be deserialized by a separate ObjectInputStream that does not apply the denylist, ultimately reaching a JNDI sink and enabling code execution.

• CWE-184Incomplete List of Disallowed InputsThe product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
• CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.