CVE-2026-67615 openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker
Authenticated attackers can execute arbitrary code in openEQUELLA by bypassing deserialization filters via nested SignedObject payloads in HTTP invoker endpoints.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-67615?
CVE-2026-67615 is a high-severity unsafe deserialization vulnerability in Apereo Foundation openEQUELLA, published on 22 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/*. Attackers can bypass the class-name denylist enforced by PluginAwareObjectInputStream by nesting a serialized payload inside a java.security.SignedObject, causing the inner stream to be deserialized by a separate ObjectInputStream that does not apply the denylist, ultimately reaching a JNDI sink and enabling code execution.
Which versions are affected by CVE-2026-67615?
How do I fix CVE-2026-67615?
No fix has been published for CVE-2026-67615 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-67615 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67615 exists.
Sources
Also known as GHSA-97gw-jwjx-fx9h, GHSA-h2p3-9m67-89gr.