CVE-2026-66088— Unrestricted Command Execution via system.execute

Quick assessment

Affected

Apereo Foundation openEQUELLA

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 2026.1 版本之前的 openEQUELLA 中，脚本引擎可用的函数会在未进行任何验证、也未使用允许的可执行文件白名单的情况下，直接运行用户提供的操作系统命令。任何能够创建或编辑脚本的用户，均可利用该函数以 openEQUELLA 服务账户的权限执行任意命令。

CVSS 9.4 · Critical Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1203 · Exploitation for Client Execution T1059 · Command and Scripting Interpreter

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Unrestricted Command Execution via system.execute

Source: CVE Program / CVE List V5

Vulnerability Description

In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L

Source: CVE Program / CVE List V5

Vulnerability Type

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apereo Foundation	openEQUELLA	0 ~ 2026.1	-

II. Public POCs for CVE-2026-66088

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-66088

请登录查看更多情报信息。

Other References for CVE-2026-66088 (2)

https://openequella.github.io/guides/ product
https://github.com/openequella/openEQUELLA/security/advisories/GHSA-q8xp-w3fr-hj4v vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-66088

Same Patch Batch · Apereo Foundation · 2026-10-29 · 6 CVEs total

CVE-2026-66090	7.1 HIGH	XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read
CVE-2026-66091	6.9 MEDIUM	Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details
CVE-2026-66089	6.1 MEDIUM	XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion
CVE-2026-66092	4.8 MEDIUM	Stored XSS in pre-login notice via reachable legacy logon route
CVE-2026-16889	4.8 MEDIUM	Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin

IV. Related Vulnerabilities

Same product: openEQUELLA

Same vendor: Apereo Foundation

Same weakness: CWE-78