CVE-2024-52577

criticalpriority · track · 37EPSS 0.031 · 88 %ileEUNLRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

3.13% (88th) EPSS

CVSS 9 · critical

Is it mine?

18 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · ncsc_nl

EPSS · scored 2026-10-27

In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could be exploited if an attacker manually crafts an Ignite message containing a vulnerable object whose class is present in the Ignite server classpath and sends it to Ignite server endpoints. Deserialization of such a message by the Ignite server may result in the execution of arbitrary code on the Apache Ignite server side.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.4–9.8

v3.19criticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.2 · impact 6

v3.19criticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · OSV

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL

v4.09.5criticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security@apache.org

v4.09.5criticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:Hsecondary · ENISA EU

v4.08.4highCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-502USCWE-502USCWE-502USCWE-502US

affected products (18)

Products and version ranges known to be affected.

Apache Software Foundation Apache Ignite2.6.0 → 2.17.0enisa_euvdEU
Apache Software Foundation Ignite2.6.0 → 2.17.0fstec_bduRU
Oracle Clusterware≤ vers:unknown/*ncsc_nlNL
Oracle Database Server≤ vers:unknown/*ncsc_nlNL
Oracle Essbase≤ vers:unknown/*ncsc_nlNL
Oracle Essbase Server≤ vers:unknown/*ncsc_nlNL
Oracle GoldenGate Big Data and Application Adapters≤ vers:unknown/*ncsc_nlNL
Oracle GoldenGate Stream Analytics≤ vers:unknown/*ncsc_nlNL
Oracle GoldenGate for Big Data≤ vers:unknown/*ncsc_nlNL
Oracle Goldengate Application Adapters≤ vers:unknown/*ncsc_nlNL
Oracle Goldengate Big Data≤ vers:unknown/*ncsc_nlNL
Oracle Goldengate Veridata≤ vers:unknown/*ncsc_nlNL
Oracle Graph Server And Client≤ vers:unknown/*ncsc_nlNL
Oracle Java Virtual Machine≤ vers:unknown/*ncsc_nlNL
Oracle REST Data Services≤ vers:unknown/*ncsc_nlNL
Oracle SQLcl≤ vers:unknown/*ncsc_nlNL
apache ignite2.6.0 → 2.17.0nvdUScpe:2.3:a:apache:ignite:*:*:*:*:*:*:*:*
Maven org.apache.ignite:ignite-core2.6.0 → 2.17.0osvUSpkg:maven/org.apache.ignite/ignite-core

advisories (2)

Vendor and ecosystem advisories describing this.

NCSC-2025-0328Kwetsbaarheden verholpen in Oracle Database productenNL2025-10-23csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in Oracle Database Server producten
GHSA-8355-xj3p-hv6qApache Ignite: Possible RCE when deserializing incoming messages by the server node2025-02-14ghsa · osvUS
In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could be exploited if an attacker manually crafts an Ignite message containing a vulnerable object whose class is present in the Ignite server classpath and sends it to Ignite server endpoints. Deserialization of such a message by the Ignite server may result in the execution of arbitrary code on the Apache Ignite server side.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu ncsc_nl nvd osv NVD CVE.org MITRE

published 2025-02-14modified 2026-06-17

references (8)

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2025/02/14/2 cnnvd
https://access.redhat.com/security/cve/cve-2024-52577 cnnvd
https://github.com/apache/ignite/releases/tag/2.17.0Patchcnnvd
https://lists.apache.org/thread/1bst0n27m9kb3b6f6hvlghn182vqb2hh cnnvd
https://www.oracle.com/security-alerts/cpuoct2025.html cnnvd
https://lists.apache.org/thread/1bst0n27m9kb3b6f6hvlghn182vqb2hh enisa_euvd
http://www.openwall.com/lists/oss-security/2025/02/14/2Mailing ListThird Party Advisorynvd
https://lists.apache.org/thread/1bst0n27m9kb3b6f6hvlghn182vqb2hhIssue TrackingMailing ListVendor Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan