CVE-2026-42404

highpriority · track · 29EPSS 0.005 · 42 %ileDEEUFRNLRUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.50% (42nd) EPSS
CVSS 7.2 · high
Is it mine?
41 products
Check your exposure
Who says so?
7 sources
cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for arbitrary protocols and internal IP adddresses. From 3.2.2, only http or https URIs are allowed, and link-local/multicast/any-local addresses are forbidden. Users are recommended to upgrade to version 3.2.2, which fixes this issue.

01

cvss

Technical severity, 0–10. One row per scoring source.

7.2
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–7.2

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 2.7
v3.17.2highAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU
v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · ENISA EU
v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · security@apache.orgexploitability 3.9 · impact 2.5
v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · OSV
v3.16.6mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)
v3.17.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:Nsecondary · NCSC-NL NL
02

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-918USCWE-918USCWE-918USCWE-918US
04

affected products (41)

Products and version ranges known to be affected.

showing 20 of 41
05

advisories (7)

Vendor and ecosystem advisories describing this.

  • NCSC-2026-0448Kwetsbaarheden verholpen in Oracle Fusion MiddlewareNL2026-10-22csaf · ncsc_nlNL

    Oracle heeft meerdere kwetsbaarheden verholpen in diverse producten, waaronder Oracle SOA Suite, Oracle WebLogic Server, Oracle Data Integrator, Oracle Identity Manager, Oracle Access Manager, Oracle WebCenter Content, Oracle Fusion Middleware (inclusief Helidon) en Oracle HTTP Server.

  • WID-SEC-W-2026-2050IBM WebSphere Application Server und Application Server Liberty: Mehrere SchwachstellenDeutsch2026-06-23csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in IBM WebSphere Application Server Liberty und IBM WebSphere Application Server ausnutzen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um beliebigen Programmcode auszuführen, um Informationen offenzulegen, und um einen Denial of Service Angriff durchzuführen.

  • WID-SEC-W-2026-2444Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2026-07-21csaf · cert_bundDE

    Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • WID-SEC-W-2026-3043IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2026-08-26csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen und um beliebigen Programmcode auszuführen.

  • WID-SEC-W-2026-4078Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2026-10-20csaf · cert_bundDE

    Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • GHSA-287c-fxr7-3w6cApache Neethi doesn't impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API2026-05-01ghsa · osvUS

    Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for arbitrary protocols and internal IP adddresses. From 3.2.2, only http or https URIs are allowed, and link-local/multicast/any-local addresses are forbidden. Users are recommended to upgrade to version 3.2.2, which fixes this issue.

  • CERTFR-2026-AVI-1378Multiples vulnérabilités dans les produits IBMFrançais2026-10-23vendor · certfrFR
06

also known as (4)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducert_bundncsc_nlosvcertfrNVDCVE.orgMITRE
published 2026-05-01modified 2026-10-26
08

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan