Apereo Foundation

Products

Product	CVEs	Exploited	Latest
openEQUELLA	7	–	Oct 29, 2026
CAS	1	–	Nov 9, 2023

CVE-2026-66092 Medium 4.8 Stored XSS in pre-login notice via reachable legacy logon route 0.3%
CVE-2026-66091 Medium 6.9 Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details 0.4%
CVE-2026-66090 High 7.1 XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read 0.3%
CVE-2026-66089 Medium 6.1 XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion 0.3%
CVE-2026-66088 Critical 9.4 Unrestricted Command Execution via system.execute 0.7%
CVE-2026-16889 Medium 4.8 Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin 0.3%
CVE-2026-67615 High 8.8 openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker 0.5%
CVE-2023-4612 Critical 9.8 MFA bypass in Apereo CAS 1.1%