CVE-2026-66088: Unrestricted Command Execution via system.execute

Severity: critical (CVSS 9.4 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-29 · updated 2026-10-29
Weakness: CWE-78

Description

In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.

Summary

openEQUELLA before 2026.1 exposes a system.execute() scripting function that runs operating system commands without validation or an allow-list, letting anyone who can create or edit scripts execute arbitrary commands as the service account. Rated CVSS 9.4 (critical), this can lead to full compromise of the openEQUELLA host and its data. It is not listed in CISA KEV and no active exploitation is reported. Upgrade to openEQUELLA 2026.1, and until then restrict script creation and editing privileges to trusted administrators.

تُتيح دالة system.execute() في openEQUELLA قبل الإصدار 2026.1 تنفيذ أوامر نظام التشغيل دون تحقق أو قائمة مسموح بها، ما يمكّن أي مستخدم قادر على إنشاء السكربتات أو تعديلها من تنفيذ أوامر عشوائية بصلاحيات حساب خدمة openEQUELLA. صُنّفت الثغرة بدرجة 9.4 (حرجة) وقد تؤدي إلى اختراق كامل للخادم وبياناته. لا ترد الثغرة في قائمة CISA KEV ولم يُبلَّغ عن استغلال فعلي لها. يُنصح بالترقية إلى openEQUELLA 2026.1، وإلى حين ذلك تقييد صلاحيات إنشاء السكربتات وتعديلها على المسؤولين الموثوقين فقط.

Affected products

Apereo Foundation openEQUELLA: before 2026.1 — fixed in 2026.1

How to fix

Upgrade to a fixed version: Apereo Foundation openEQUELLA 2026.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-66088 or the next vulnerability affects your stack