CVE-2026-19135 OpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classes

A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an...