CVE-2026-82384— Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint
Quick assessment
Affected
Apache Software Foundation Apache Roller
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Roller 6.1.5 中存在不受信任数据反序列化漏洞，允许未经身份验证的远程攻击者触发对攻击者可控字节的反序列化操作。原因在于 XML-RPC 端点在请求解析阶段会反序列化供应商扩展类型（vendor extension types），而该过程发生在身份验证之前。由于该 Servlet 被无条件映射，即使全局 XML-RPC 功能被设置为禁用，解析操作仍会执行，因此无需进行任何非默认配置即可利用此路径。该漏洞可能导致远程代码执行。建议用户升级到 Apache Roller 6.1.6 或更高版本，
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82384
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is mapped unconditionally, so parsing occurs even when the global XML-RPC feature is set to disabled; no non-default configuration is required for this path. This can lead to remote code execution. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which disables the extension types and rejects requests when the XML-RPC feature is disabled.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Roller | 6.1.5 | - |
|
II. Public POCs for CVE-2026-82384
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82384
请登录查看更多情报信息。
Other References for CVE-2026-82384 (2)
-
https://lists.apache.org/thread/21p1dh6x179gmcdpw84kkx9yclrdp410 vendor-advisory
Same Patch Batch · Apache Software Foundation · 2026-09-28 · 20 CVEs total
| CVE-2026-82377 | 9.9 CRITICAL | Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers |
| CVE-2026-82378 | 9.0 CRITICAL | Apache Roller: OAuth authorization endpoint trusts request-supplied identity |
| CVE-2026-82383 | 8.2 HIGH | Apache Roller: Anonymous setup action allows frontpage configuration tampering |
| CVE-2026-82380 | 8.1 HIGH | Apache Roller: CSRF protection bypass via self-generated salt validation |
| CVE-2026-82379 | 7.7 HIGH | Apache Roller: WSSE digest authentication headers can be replayed |
| CVE-2026-82348 | 7.7 HIGH | Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups |
| CVE-2026-82386 | 7.7 HIGH | Apache Roller: XML external entity processing in OPML bookmark import |
| CVE-2026-82376 | 7.7 HIGH | Apache Roller: XML external entity processing in trackback response parser |
| CVE-2026-82375 | 7.4 HIGH | Apache Roller: Server-side request forgery via entry trackback and enclosure URLs |
| CVE-2026-82385 | 6.5 MEDIUM | Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath fi |
| CVE-2026-91206 | 6.1 MEDIUM | Apache Roller: Reflected XSS in the optional LDAP comment authenticator |
| CVE-2026-91204 | 6.1 MEDIUM | Apache Roller: Stored javascript: URI in HTML comments |
| CVE-2026-82546 | 6.1 MEDIUM | Apache Roller: Stored cross-site scripting through incoming Trackback links |
| CVE-2026-82382 | 6.1 MEDIUM | Apache Roller: Reflected cross-site scripting in the frontpage directory parameter |
| CVE-2026-86507 | 6.1 MEDIUM | Apache Roller: Stored XSS in comment moderation via comment author URL |
| CVE-2026-82381 | 5.4 MEDIUM | Apache Roller: Stored cross-site scripting in the authoring UI |
| CVE-2026-82387 | 5.4 MEDIUM | Apache Roller: Stored cross-site scripting via uploaded media content type |
| CVE-2026-90979 | Apache Karaf: LDAP filter injection in JAAS LDAP login modules | |
| CVE-2026-91006 | Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean) |
IV. Related Vulnerabilities
Same product: Apache Roller
-
CVE-2026-86507
Apache Roller: Stored XSS in comment moderation via comment -
CVE-2026-82379
Apache Roller: WSSE digest authentication headers can be rep -
CVE-2026-82380
Apache Roller: CSRF protection bypass via self-generated sal -
CVE-2026-82381
Apache Roller: Stored cross-site scripting in the authoring -
CVE-2026-82382
Apache Roller: Reflected cross-site scripting in the frontpa
Same vendor: Apache Software Foundation
-
CVE-2026-91006
Apache Karaf: OS Command Injection in Child-Instance Launch -
CVE-2026-90979
Apache Karaf: LDAP filter injection in JAAS LDAP login modul -
CVE-2026-86507
Apache Roller: Stored XSS in comment moderation via comment -
CVE-2026-82379
Apache Roller: WSSE digest authentication headers can be rep -
CVE-2026-82380
Apache Roller: CSRF protection bypass via self-generated sal
Same weakness: CWE-502
-
CVE-2026-81867
Deserialization of Untrusted Data in Application Integration -
CVE-2026-100846
MONAI before 1.5.2 Remote Code Execution via Pickle Deserial -
CVE-2026-100845
MONAI before 1.6.0 Remote Code Execution via NumpyReader -
CVE-2026-100843
MONAI before 1.6.0 Remote Code Execution via algo_from_pickl -
CVE-2026-100841
MONAI through 1.6.0 PersistentDataset Remote Code Execution
V. Comments for CVE-2026-82384
No comments yet