CVE-2026-75840 ArcadeData CVE debrief

Who should care

Defenders responsible for ArcadeDB systems, particularly those with trigger creation privileges, should assess exposure and potential impact. They should verify affected versions and configurations, and implement compensating controls to limit access to sensitive files. Defenders should also review relevant monitoring, detection, and logs for exposed assets.

Why it matters

Defenders should care about CVE-2026-75840 because it allows attackers with trigger creation privileges to read arbitrary files on the host system, potentially leading to unauthorized file access, data breaches, or system compromise. Verification of affected versions and remediation is necessary.

• Potential unauthorized file access
• Possible data breaches or system compromise
• Need for verification of affected versions and remediation

Technical summary

The vulnerability is caused by unescaped regular expressions used to validate package names in the GraalVM JavaScript sandbox allowlist enforcement. Attackers with trigger creation privileges can exploit this vulnerability to access java.util.zip.ZipFile or java.util.jar.JarFile classes and read arbitrary files on the host system as the ArcadeDB server process. The vulnerability allows unauthorized file access, potentially leading to data breaches or system compromise. Defenders should prioritize verifying exposure and assessing potential impact.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on systems with trigger creation privileges.

Recommended defensive actions

• Verify exposure by checking ArcadeDB versions and configurations
• Assess potential impact on systems with trigger creation privileges
• Implement compensating controls to limit access to sensitive files
• Review relevant monitoring, detection, and logs for exposed assets
• Check for exceptions and retest remediated assets
• Track changes to ArcadeDB systems and configurations
• Review vendor-supported updates or mitigations

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Additional information on affected versions and remediation is needed. The vulnerability allows attackers to read arbitrary files on the host system as the ArcadeDB server process. Verification of affected versions and remediation is necessary. The CVE Program record and NVD detail page offer source-provided CVE metadata and vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.