CVE-2026-67615 Apereo Foundation CVE debrief

Who should care

Defenders responsible for openEQUELLA instances, especially those with authenticated users, should assess exposure and prioritize verification and potential remediation. This includes operators managing openEQUELLA deployments, platform administrators, vulnerability management teams, and security teams that need to evaluate the risk and implement necessary mitigations.

Why it matters

CVE-2026-67615 is an authenticated remote code execution vulnerability in openEQUELLA before 2026.1.0, allowing authenticated non-guest users to execute arbitrary code via Java deserialization in the HTTP invoker endpoint. Defenders should prioritize verifying exposure, especially for instances with authenticated users, and assess exploitation feasibility. The vulnerability's details and potential impacts require verification from official sources.

• Potential code execution by authenticated users.
• Bypass of class-name denylist via nested serialized payload.
• Reach of JNDI sink for enabling code execution.
• Verification priority for openEQUELLA instances and user authentication.

Technical summary

The vulnerability allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/*. Attackers can bypass the class-name denylist enforced by PluginAwareObjectInputStream by nesting a serialized payload inside a java.security.SignedObject, causing the inner stream to be deserialized by a separate ObjectInputStream that does not apply the denylist, ultimately reaching a JNDI sink and enabling code execution.

Defensive priority

Defenders should prioritize verifying exposure of openEQUELLA instances, especially those with authenticated users, and assess the feasibility of exploitation given the deserialization vulnerability.

Recommended defensive actions

• Verify openEQUELLA instances for exposure, especially those with authenticated users.
• Assess the feasibility of exploitation given the deserialization vulnerability.
• Prioritize upgrading to version 2026.1.0 or later.
• Monitor for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 8.7 and HIGH severity. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the provided information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.