Vulnerability · Published Oct 29, 2026 · Assigned by MON-CSIRT

CVE-2026-66088Unrestricted Command Execution via system.execute

Critical 9.4

In plain English

A critical-severity OS command injection in openEQUELLA from Apereo Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)0.7%top 47.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.

Affected products (as reported)

Vendor	Product	Versions
Apereo Foundation	openEQUELLA	0 – before 2026.1

Weakness: CWE-78, CWE-749 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L

References

https://github.com/openequella/openEQUELLA/security/advisories/GHSA-q8xp-w3fr-hj4v vendor-advisory
https://openequella.github.io/guides/ product