Vulnerability · Published Jul 17, 2026 · Assigned by apache

CVE-2026-62764Apache Accumulo: A user can trigger a graceful shutdown of services without the relevant system permissions

Medium 5.7

In plain English

A medium-severity security flaw in Apache Accumulo from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 4.0)5.7Medium

Exploit odds (30 days)0.8%top 43.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo. An authenticated, but low-privileged user without system permissions may issue a remote command to gracefully shutdown system components (compaction-coordinator, compactor, gc, manager, monitor, tserver, or sserver), leading to a denial of service. This issue affects Apache Accumulo 2.1.4 and 2.1.5. Users are recommended to upgrade to version 2.1.6, which fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Accumulo	2.1.4 – through 2.1.5

Weakness: CWE-274 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:D/RE:L/U:Green

References

https://github.com/apache/accumulo/issues/6478 issue-tracking
https://accumulo.apache.org/release/accumulo-2.1.6/ release-notes, vendor-advisory
https://accumulo.apache.org/downloads/ product, patch
https://lists.apache.org/thread/qclg736k93oqn4qrpw9wxjbb3jhn6gm1 vendor-advisory
http://www.openwall.com/lists/oss-security/2026/07/17/6