CVE-2026-120209 anji-plus CVE debrief

Who should care

Defenders responsible for AJ-Report instances, security teams, and developers should be aware of this critical vulnerability and take immediate action to prevent exploitation. This includes verifying AJ-Report version 1.7.1 usage, updating or patching instances, restricting access to the testTransform endpoint, and monitoring for suspicious activity related to Share-Tokens and GroovyClassLoader usage. Prioritization should be given to verifying the use of

Why it matters

CVE-2026-120209 is a critical vulnerability in AJ-Report through version 1.7.1, allowing forging of valid Share-Tokens and unauthenticated remote code execution. Defenders should prioritize verifying the use of AJ-Report version 1.7.1 and ensuring that any instances are updated or patched to prevent exploitation.

• Potential for unauthenticated remote code execution
• Forging of valid Share-Tokens offline
• Access to the testTransform endpoint without authentication
• Possible exploitation via GroovyClassLoader

Technical summary

The AJ-Report system through version 1.7.1 uses a hard-coded JWT secret to sign share tokens, allowing attackers to forge valid tokens offline. By minting a token with reportCode 'dataSet', attackers can access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution. This vulnerability has a critical CVSS score of 9.3 and requires immediate attention from defenders. The technical impact includes potential for unauthenticated remote code execution, forging of valid Share-Tokens offline, and access to the testTransform endpoint without authentication.

Defensive priority

Defenders should prioritize verifying the use of AJ-Report version 1.7.1 and ensuring that any instances are updated or patched to prevent exploitation.

Recommended defensive actions

• Verify AJ-Report version and ensure instances are updated or patched
• Restrict access to the testTransform endpoint
• Monitor for suspicious activity related to Share-Tokens and GroovyClassLoader usage
• Implement compensating controls for exposed systems
• Conduct an asset inventory to identify potentially affected systems
• Review and track exceptions for remediated assets
• Plan and execute a rollback or change window for updates

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its critical CVSS score of 9.3, potential for remote code execution, and the need for defenders to verify AJ-Report version 1.7.1 usage and update or patch instances. The vulnerability allows forging of valid Share-Tokens offline and access to the testTransform endpoint without authentication. Defenders should prioritize verifying the use of AJ-Report version 1.7.1 and ensuring that any instances are updated or patched to prevent exploitation. Evidence is in

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.