CVE-2025-13426

A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution. It is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute...

CVE-2025-13426

CVE-2025-13426 affects Google Apigee’s JavaCallout policy. A crafted JavaCallout could inject a malicious object into the MessageContext to execute arbitrary Java code and system commands at runtime, enabling unauthorized data access and lateral movement. Public disclosures in the initial documen...

CVE-2025-13426 Improper Sandboxing in Google Apigee's JavaCallout Policy Allows for Remote Code Execution

A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution. It is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute...