CVE-2026-86228 jeecgboot CVE debrief

Who should care

Defenders responsible for JeecgBoot instances, particularly those using versions up to 3.9.3, should assess exposure and verify the effectiveness of existing compensating controls.

Why it matters

CVE-2026-86228 is a security vulnerability in JeecgBoot up to 3.9.3 that allows for improper access controls, enabling remote attacks. Defenders should prioritize verifying exposure, assessing compensating controls, and upgrading affected instances.

• Verify exposure of JeecgBoot instances to remote attacks
• Assess the effectiveness of existing compensating controls
• Prioritize upgrading affected instances to version 3.9.5

Technical summary

The vulnerability affects the function exportXls of the file jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/controller/AiragModelController.java in JeecgBoot up to 3.9.3, allowing for improper access controls due to manipulation of the argument credential. This vulnerability enables remote attacks, emphasizing the need for defenders to verify exposure, assess compensating controls, and prioritize upgrading affected instances to version 3.9.5 where the patch a2be896f753936956ee6863b632b8e5a0231345c is applied, ensuring the security of JeecgBoot instances, particularly those using versions up to 3.9.3, and validating the effectiveness of existing security measures against this specific vulnerability. The exploit has been disclosed publicly and may be used. Upgrading to version 3.9.5 is able to resolve this issue. The name of the patch is a2be896f753936956ee6863b632b8e5a0231345c. It is possible to launch the attack remotely. A security vulnerability has been detected in JeecgBoot up to 3.9.3. This vulnerability affects the function exportXls of the file jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/controller/AiragModelController.java. Such manipulation of the argument credential leads to improper access controls. Defenders should prioritize verifying exposure of JeecgBoot instances, particularly those using versions up to 3.9.3, and assess the effectiveness of existing compensating controls. The CVE record and source metadata indicate a security vulnerability in JeecgBoot up to 3.9.3, with a patch available in version 3.9.5. However, details about the vulnerability's impact and exploitation are limited. The vulnerability affects the function exportXls of the file jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/controller/AiragModelController.java in JeecgBoot up to 3.9.3, allowing for improper access controls due to manipulation of the argument credential. This vulnerability enables remote attacks, emphasizing the need for defenders to verify exposure, assess compensating controls, and prioritize upgrading affected 520

Defensive priority

Defenders should prioritize verifying exposure of JeecgBoot instances, particularly those using versions up to 3.9.3, and assess the effectiveness of existing compensating controls.

Recommended defensive actions

• Verify JeecgBoot instances for exposure, particularly those using versions up to 3.9.3
• Assess the effectiveness of existing compensating controls
• Upgrade affected instances to version 3.9.5
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source metadata indicate a security vulnerability in JeecgBoot up to 3.9.3, with a patch available in version 3.9.5. However, details about the vulnerability's impact and exploitation are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.