CVE-2026-86218

CVE-2026-86218 CVE-2026-86218 - N-able N-central Struts BeanUtils Unauthenticated RCE | ---|--- CVE| CVE-2026-86218 CVSS| 10.0 Critical Affected| N-central on-premises 2026.3.1.14 including Hotfix 3 Fixed| 2026.3 Hotfix 4 build 2026.3.1.14 Disclosed| 2026-09-05 CWE| CWE-96 Static Code Injection...

CVE-2025-48734

CVE-2025-48734: Apache Commons BeanUtils – enum declaringClass Information Leak & RCE Chain For educational and authorized security research purposes only. This repository provides a controlled lab environment to reproduce the CVE-2025-48734 vulnerability in Apache Commons BeanUtils and explore h...

CVE-2025-24813-noPoC

CVE-2025-24813-noPoC After countless hours I was unable to come up with any real PoC. While the deserialization of uploaded files could pose a threat, all payload-chains I tested failed. Tested on versions 9.0.90 and 10.1.15 of Apache Tomcat Nothing else to see here! SEVERE http-nio-8080-exec-5...

strutt-cve-2014-0114

CVE-2014-0114 - Vulnerability in Struts 1 Parameters in a POST or GET request are handled as properties to be set with the form as a starting point. Parameters can be a path to a nested object. Apache Struts 1.x can be manipulated to call getClass on Form Beans. For example, one can directly...

Astra Linux – Vulnerability in Commons-BeanUtils

Apache Commons has a vulnerability related to improper access control. A special BeanIntrospector class was added in version 1.9.2. This can be used to prevent attackers from using the declared class property of Java enum objects to gain access to the classloader. However, this protection was not...

CLSA-2026-1792010669 TuxCare security update for commons-beanutils:commons-beanutils (1 CVE)

TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.9.0-tuxcare.2...

CLSA-2026-1791878536 TuxCare security update for commons-beanutils:commons-beanutils (3 CVEs)

TuxCare rebuilt commons-beanutils:commons-beanutils to address 3 CVEs. Fixed in 1.9.3-tuxcare.1...

Astra Linux – Vulnerability in Commons-BeanUtils

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added, which enables suppressing the ability for an attacker to access the classloader through the class property available on all Java objects. However, we did not use this feature by default, as it is a characteristic of...

Rocky Linux 9 [CIQ] Security Update: apache-commons-beanutils (crlsa-2025_9114)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20259114 advisory. commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default CVE-2025-48734 Tenable has extracted...

Rocky Linux 10.0 [CIQ] Security Update: apache-commons-beanutils / apache-commons-beanutils-javadoc (crlsa-2025_9166)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259166 advisory. commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default CVE-2025-48734 Tenable has extract...

Rocky Linux 8 [CIQ] Security Update: ant / ant-antlr / ant-apache-bcel / ant-apache-bsf / etc Multiple Vulnerabilities (crlsa-2025_9318)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20259318 advisory. apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default CVE-2019-10086 commons-beanutils: Apache Commons BeanUtils...

ROOT-APP-MAVEN-CVE-2014-0114 CVE-2014-0114 in commons-beanutils:commons-beanutils - Patched by Root

Root has patched CVE-2014-0114 in the commons-beanutils:commons-beanutils package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2019-10086 CVE-2019-10086 in commons-beanutils:commons-beanutils - Patched by Root

Root has patched CVE-2019-10086 in the commons-beanutils:commons-beanutils package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-48734 CVE-2025-48734 in commons-beanutils:commons-beanutils - Patched by Root

Root has patched CVE-2025-48734 in the commons-beanutils:commons-beanutils package for Root:Maven. Multiple fixed versions available...

CLSA-2026-1788757915 TuxCare security update for commons-beanutils:commons-beanutils (1 CVE)

TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.10.0-tuxcare.1...

CLSA-2026-1788757862 TuxCare security update for commons-beanutils:commons-beanutils (1 CVE)

TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.9.2-tuxcare.1...

PT-2026-94211

TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.10.0-tuxcare.1...

PT-2026-94207

TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.9.2-tuxcare.1...

N-able N-central Struts BeanUtils Unauthenticated RCE

N-able N-central before 2026.3.1.14 uses a session-scoped Struts form on an unauthenticated action. Two concurrent multipart requests can race the form's multipart handler and expose Jetty's live configuration to Commons BeanUtils property population. This module changes a lazy N-central servlet...

GHSA-H84G-69H7-MW6V mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

Impact Prior to version 0.6.0, mchange-commons-java includes a JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory willing to construct objects of arbitrary classes and initialize "JavaBean"-style properties. There are classes for which this kind of initialization is...