Critical severity · published Oct 29, 2026
CVE-2026-66088
Unrestricted Command Execution via system.execute
New
9.4
CVSS
–
EPSS
No
On KEV
Description
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openEQUELLA · Apereo Foundation
before 2026.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-66088
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-66088
vendor-advisory
https://github.com/openequella/openEQUELLA/security/advisories/GHSA-q8xp-w3fr-hj4v
product
https://openequella.github.io/guides/
More from openEQUELLA
8.8
CVE-2026-67615
openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker
7.1
CVE-2026-66090
XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read
6.9
CVE-2026-66091
Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details
6.1
CVE-2026-66089
XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion
4.8
CVE-2026-66092
Stored XSS in pre-login notice via reachable legacy logon route