CVE-2026-66713 (GCVE-0-2026-66713)
Vulnerability from cvelistv5
Published
2026-07-28 13:44
Modified
2026-07-29 03:55
Severity ?
CWE
  • CWE-502 - Deserialization of Untrusted Data
Summary
Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component  in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat  (only when Tribes clustering is enabled, which is off by default) allows an  unauthenticated remote attacker with network access to the clustering port to  execute arbitrary code via a crafted serialized Java object delivered to the cluster  channel and deserialized in  org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are  recommended to upgrade to version 2.0.1, which fixes this issue by removing the  clustering feature entirely.
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Axis2/Java Version: 0   ≤ 2.0.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-66713",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-29T03:55:41.433Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-28T14:53:41.497Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/28/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Axis2/Java",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "liuhuajin of Huawei"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eDeserialization\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eof\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUntrusted\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eData\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e(CWE-502)\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ein\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ethe\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eTribes-based\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eclustering\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ecomponent\u003c/span\u003e\n\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e \u0026nbsp;in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat\u003c/span\u003e\n\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e \u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e(only\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ewhen\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eTribes\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eclustering\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eis\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eenabled,\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ewhich\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eis\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eoff\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eby\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003edefault)\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eallows\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ean\u003c/span\u003e\n\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e \u0026nbsp;unauthenticated remote attacker with network access to the clustering port to\u003c/span\u003e\n\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e \u0026nbsp;execute\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003earbitrary\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ecode\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003evia\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ea\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ecrafted\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eserialized\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eJava\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eobject\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003edelivered\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eto\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ethe\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ecluster\u003c/span\u003e\n\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e \u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003echannel\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eand\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003edeserialized\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ein\u003c/span\u003e\n\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e \u0026nbsp;org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are\u003c/span\u003e\n\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e \u0026nbsp;recommended\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eto\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eupgrade\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eto\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eversion\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e2.0.1,\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ewhich\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003efixes\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ethis\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eissue\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eby\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eremoving\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ethe\u003c/span\u003e\n\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e \u0026nbsp;clustering feature entirely.\u003c/span\u003e\u003cbr\u003e\n\u003cbr\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component\n\n \u00a0in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat\n\n \u00a0(only when Tribes clustering is enabled, which is off by default) allows an\n\n \u00a0unauthenticated remote attacker with network access to the clustering port to\n\n \u00a0execute arbitrary code via a crafted serialized Java object delivered to the cluster\n\n \u00a0channel and deserialized in\n\n \u00a0org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are\n\n \u00a0recommended to upgrade to version 2.0.1, which fixes this issue by removing the\n\n \u00a0clustering feature entirely."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T13:44:29.702Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/axis-axis2-java-core/commit/e6f53b230bddcb40577c84ff290ba51e7265fa15"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/fgggbv3sjjqw7p6q0j88gspt9b2rb728"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Axis2/Java: deserialization of untrusted Data",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-66713",
    "datePublished": "2026-07-28T13:44:29.702Z",
    "dateReserved": "2026-07-27T14:49:00.907Z",
    "dateUpdated": "2026-07-29T03:55:41.433Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/07/28/2\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-07-28T14:53:41.497Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-66713\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-28T14:43:46.318199Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-28T14:43:41.645Z\"}}], \"cna\": {\"title\": \"Apache Axis2/Java: deserialization of untrusted Data\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"liuhuajin of Huawei\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"low\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Axis2/Java\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.0.0\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/apache/axis-axis2-java-core/commit/e6f53b230bddcb40577c84ff290ba51e7265fa15\", \"tags\": [\"patch\"]}, {\"url\": \"https://lists.apache.org/thread/fgggbv3sjjqw7p6q0j88gspt9b2rb728\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component\\n\\n \\u00a0in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat\\n\\n \\u00a0(only when Tribes clustering is enabled, which is off by default) allows an\\n\\n \\u00a0unauthenticated remote attacker with network access to the clustering port to\\n\\n \\u00a0execute arbitrary code via a crafted serialized Java object delivered to the cluster\\n\\n \\u00a0channel and deserialized in\\n\\n \\u00a0org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are\\n\\n \\u00a0recommended to upgrade to version 2.0.1, which fixes this issue by removing the\\n\\n \\u00a0clustering feature entirely.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eDeserialization\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eof\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eUntrusted\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eData\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e(CWE-502)\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003ein\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003ethe\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eTribes-based\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eclustering\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003ecomponent\u003c/span\u003e\\n\u003cbr\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e \u0026nbsp;in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat\u003c/span\u003e\\n\u003cbr\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e \u0026nbsp;\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e(only\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003ewhen\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eTribes\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eclustering\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eis\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eenabled,\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003ewhich\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eis\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eoff\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eby\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003edefault)\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eallows\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003ean\u003c/span\u003e\\n\u003cbr\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e \u0026nbsp;unauthenticated remote attacker with network access to the clustering port to\u003c/span\u003e\\n\u003cbr\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e \u0026nbsp;execute\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003earbitrary\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003ecode\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003evia\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003ea\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003ecrafted\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eserialized\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eJava\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eobject\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003edelivered\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eto\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003ethe\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003ecluster\u003c/span\u003e\\n\u003cbr\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e \u0026nbsp;\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003echannel\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eand\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003edeserialized\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003ein\u003c/span\u003e\\n\u003cbr\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e \u0026nbsp;org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are\u003c/span\u003e\\n\u003cbr\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e \u0026nbsp;recommended\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eto\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eupgrade\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eto\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eversion\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e2.0.1,\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003ewhich\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003efixes\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003ethis\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eissue\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eby\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eremoving\u003c/span\u003e \u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003ethe\u003c/span\u003e\\n\u003cbr\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e \u0026nbsp;clustering feature entirely.\u003c/span\u003e\u003cbr\u003e\\n\u003cbr\u003e\\n\\n\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-502\", \"description\": \"CWE-502 Deserialization of Untrusted Data\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-07-28T13:44:29.702Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-66713\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-29T03:55:41.433Z\", \"dateReserved\": \"2026-07-27T14:49:00.907Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2026-07-28T13:44:29.702Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.