Apereo Foundation CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Apereo Foundation CVE published 2026-09-22

CVE-2026-67615

CVE-2026-67615 is an authenticated remote code execution vulnerability in openEQUELLA before version 2026.1.0. The vulnerability allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint. Attackers can bypass the class-name denylist by nesting a serialized payload inside a java.security.SignedObject, ultimately reaching a JNDI sink an [truncated]