CVE-2026-94301: apache software foundation apache mina Deserialization of Untrusted Data
Vulnerability summary
CVE-2026-94301 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in apache software foundation apache mina. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.9% of scored vulnerabilities.
Timeline
- 21-09-2026PublishedVulnerability first disclosed.
- 22-09-2026Last modifiedVulnerability information updated.
Description
The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the 2.2.X branch only. The 2.0.X and 2.1.X maintenance branches never received the resolveProxyClass() override, so the 2.0.29 and 2.1.13 artifacts listed as fixed -- and every later release on those lines, up to and including the current 2.0.30 and 2.1.14 -- remain vulnerable to the exact allow-list bypass that CVE-2026-47065 was meant to close.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.39%
Chance of exploitation in the next 30 days
Percentile
32%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache software foundation1 product
- apache mina≥ 2.0.0, < 2.0.31 | ≥ 2.1.0, < 2.1.15
Ubuntu1 product
- mina2All versions (No fix recorded)
2 vendors · 2 products