High severity · published May 19, 2026
CVE-2026-6009
Jaspersoft Library Deserialisation Vulnerability
8.7
CVSS
0.5%
EPSS
No
On KEV
Description
Java Deserialisation Vulnerability in Jaspersoft Reports Library leads to Remote Code Execution (RCE), potentially allowing code execution on the affected system
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JI
JasperReports IO At-Scale · Jaspersoft
through 10.0.0 · source: vendor
JI
JasperReports IO Professional · Jaspersoft
through 10.0.0 · source: vendor
JL
JasperReports Library Community Edition · Jaspersoft
through 7.0.6 · source: vendor
JL
JasperReports Library Professional · Jaspersoft
through 10.0.0 · source: vendor
JS
JasperReports Server · Jaspersoft
through 10.0.0 · source: vendor
JW
JasperReports Web Studio · Jaspersoft
through 10.0.1 · source: vendor
JS
Jaspersoft Studio Community Edition · Jaspersoft
through 7.0.6 · source: vendor
JS
Jaspersoft Studio Professional · Jaspersoft
through 10.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6009
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6009
community.jaspersoft.com
https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-may-19-2026-jaspersoft-library-cve-2026-6009-r11/
More from JasperReports IO At-Scale
9.8
CVE-2025-10492
Jaspersoft Library Deserialisation Vulnerability