CVE-2026-67615

Summary

This vulnerability allows authenticated non-guest users to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint, leading to remote code execution.

Exploitability

Exploitation requires an authenticated non-guest user and knowledge of the specific Java deserialization payload. The attacker must bypass the class-name denylist enforced by PluginAwareObjectInputStream.

Blast radius

If exploited, the impact is high, as it allows for full control over the system, potentially leading to data loss, system compromise, and further attacks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to openEQUELLA 2026.1.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.