CVE-2026-46581 Eclipse Foundation CVE debrief

Who should care

Organizations using Eclipse Mojarra versions 2.3 and later should prioritize patching to prevent potential remote code execution. The vulnerability has a CVSS score of 7.5 and a severity of HIGH, indicating a high level of risk. Organizations should review and restrict access to sensitive files such as WEB-INF/web.xml or /etc/passwd, and implement additional security measures to monitor and detect potential attacks. The CVE record was published on 2026-08-05T12:18:57.190Z and has not been modified since then. The vulnerability affects Eclipse Mojarra versions 2.3 and later, and could allow access to restricted files such as WEB-INF/web.xml or /etc/passwd. The vulnerability has a CVSS score of 7.5 and a severity of HIGH, indicating a high level of risk. The CVE record was published on 2026-08-05T12:18:57.190Z and has not been modified since then. The vulnerability affects Eclipse Mojarra versions 2.3 and later, and could allow access to restricted files such as WEB-INF/web.xml or /etc/passwd. The vulnerability has a CVSS score of 7.5 and a severity of HIGH, indicating a high level of risk. The CVE record was published on 2026-08-05T12:18:57.190Z and has not been modified since then. The vulnerability affects Eclipse Mojarra versions 2.3 and later, and could allow access to restricted files such as WEB-INF/web.xml or /etc/passwd. The vulnerability has a CVSS score of 7.5 and a severity of HIGH, indicating a high level of risk. The CVE record was published on 2026-08-05T12:18:57.190Z and has not been modified since then. The vulnerability affects Eclipse Mojarra versions 2.3 and later, and could allow access to restricted files such as WEB-INF/web.xml or /etc/passwd. The vulnerability has a CVSS score of 7.5 and a severity of HIGH, indicating a high level of risk. The CVE record was published on 2026-08-05T12:18:57.190Z and has not been modified since then. The vulnerability affects Eclipse Mojarra versions 2.3 and later, and could allow access to restricted files such as WEB-INF/web.xml or /etc/passwd. The vulnerability has a CVSS score of 7.5 and a severity of HIGH, indicating a high level of risk. The CVE record was published on 2026-08-05T12:18:57.190Z and has

Technical summary

The CVE-2026-46581 vulnerability is caused by a flaw in the URL handling in DefaultFaceletFactory in Eclipse Mojarra versions 2.3 and later. This allows an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as WEB-INF/web.xml or /etc/passwd. The vulnerability has a CVSS score of 7.5 and a severity of HIGH. Organizations should prioritize patching to prevent potential remote code execution.

Defensive priority

Organizations using Eclipse Mojarra versions 2.3 and later should prioritize patching to prevent potential remote code execution.

Recommended defensive actions

• Apply patches or updates provided by the vendor to address the vulnerability
• Review and restrict access to sensitive files such as `WEB-INF/web.xml` or `/etc/passwd`
• Implement additional security measures to monitor and detect potential attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE description indicates that Eclipse Mojarra versions 2.3 and later have a vulnerability in URL handling in `DefaultFaceletFactory`, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.