Vulnerability-Lookup

SUSE-SU-2026:22858-1

Vulnerability from csaf_suse - Published: 2026-07-22 17:48 - Updated: 2026-09-16 20:06

Summary

Security update for apache-ivy

Severity

Moderate

Notes

Title of the patch: Security update for apache-ivy

Description of the patch: This update for apache-ivy fixes the following issue: - CVE-2026-26032: directory traversal sequences in module coordinates can allow overwriting arbitrary files outside the configured "buildRoot" directory (bsc#1271727). Changes for apache-ivy: - Upgrade to 2.6.0: + the ivy:retrieve task failed when the retrieve pattern contained some text in parentheses before the first token, for instance: /jobs/lib (JDK 17)/[artifact].[ext] (IVY-1660) + when the ivy:deliver task is configured to replace dynamic revisions, it now replaces these revisions to the resolved revision before any conflict resolution was done, which was the original behavior before Ivy 2.3.0. This way, the delivered ivy.xml can be used to have reproducible dependency resolution, especially when multiple configurations are used. It also fixes issues where the dynamic revisions were replaced by versions from other configurations. (IVY-1485, IVY-1661) + the ivy:deliver task didn't replace dynamic revision from inherited dependencies. (IVY-1410) + the ivy:install task didn't take the from resolver into account when resolving Maven parent modules or source/javadoc artifacts. + the ivy:checkdepsupdate task could suggest a lesser version as update. (IVY-1665) + the ivy:makepom task no longer adds a dependency to the dependencyManagement section. (IVY-1667) + the ivy:deliver task didn't include XML namespaces from a parent ivy module when merging the descriptors. (IVY-1658) + the ivy:checkdepsupdate task no longer shows evicted versions. (IVY-1662) * Improvements + use Apache Commons Compress for pack200 handling to avoid issues on Java 14 and later. If pack200 is needed, make sure to add Apache Commons Compress to your classpath. (IVY-1652) + ivy:retrieve and the 'post resolve tasks' now support the override child element. (IVY-1664) + ivy:makepom will now add override elements of the ivy.xml to the dependencyManagement section of the generated pom. (IVY-1663) + ivy:deliver and ivy:publish now writes inherited dependencies first to preserve resolve order (IVY-1656) + ModuleRevisionId.encodeToString now returns a deterministic string that doesn't rely on a implmentation of HashMap * New feature + added a new nearest conflict manager, which handles conflicts in the same way that Maven does. (IVY-813)

Patchnames: SUSE-SLES-16.0-1335

CVE-2026-26032

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:apache-ivy-2.6.0-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:apache-ivy-javadoc-2.6.0-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:apache-ivy-2.6.0-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:apache-ivy-javadoc-2.6.0-160000.1.1.noarch	—	Vendor Fix

Threats

Impact moderate

References

8 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1271727	self
https://www.suse.com/security/cve/CVE-2026-26032/	self
https://www.suse.com/security/cve/CVE-2026-26032	external
https://bugzilla.suse.com/1271727	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for apache-ivy",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for apache-ivy fixes the following issue:\n\n- CVE-2026-26032: directory traversal sequences in module coordinates can allow overwriting arbitrary files outside\n  the configured \"buildRoot\" directory (bsc#1271727).\n\nChanges for apache-ivy:\n\n- Upgrade to 2.6.0:\n\n + the ivy:retrieve task failed when the retrieve pattern\n contained some text in parentheses before the first token, for\n instance: /jobs/lib (JDK 17)/[artifact].[ext] (IVY-1660)\n + when the ivy:deliver task is configured to replace dynamic\n revisions, it now replaces these revisions to the resolved\n revision before any conflict resolution was done, which was\n the original behavior before Ivy 2.3.0. This way, the\n delivered ivy.xml can be used to have reproducible dependency\n resolution, especially when multiple configurations are used.\n It also fixes issues where the dynamic revisions were replaced\n by versions from other configurations. (IVY-1485, IVY-1661)\n + the ivy:deliver task didn\u0027t replace dynamic revision from\n inherited dependencies. (IVY-1410)\n + the ivy:install task didn\u0027t take the from resolver into\n account when resolving Maven parent modules or\n source/javadoc artifacts.\n + the ivy:checkdepsupdate task could suggest a lesser version as\n update. (IVY-1665)\n + the ivy:makepom task no longer adds a dependency to the\n dependencyManagement section. (IVY-1667)\n + the ivy:deliver task didn\u0027t include XML namespaces from a\n parent ivy module when merging the descriptors. (IVY-1658)\n + the ivy:checkdepsupdate task no longer shows evicted versions.\n (IVY-1662)\n * Improvements\n + use Apache Commons Compress for pack200 handling to avoid\n issues on Java 14 and later. If pack200 is needed, make sure\n to add Apache Commons Compress to your classpath. (IVY-1652)\n + ivy:retrieve and the \u0027post resolve tasks\u0027 now support the\n override child element. (IVY-1664)\n + ivy:makepom will now add override elements of the ivy.xml to\n the dependencyManagement section of the generated pom.\n (IVY-1663)\n + ivy:deliver and ivy:publish now writes inherited dependencies\n first to preserve resolve order (IVY-1656)\n + ModuleRevisionId.encodeToString now returns a deterministic\n string that doesn\u0027t rely on a implmentation of HashMap\n * New feature\n + added a new nearest conflict manager, which handles conflicts\n in the same way that Maven does. (IVY-813)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLES-16.0-1335",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22858-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:22858-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622858-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:22858-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027898.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271727",
        "url": "https://bugzilla.suse.com/1271727"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-26032 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-26032/"
      }
    ],
    "title": "Security update for apache-ivy",
    "tracking": {
      "current_release_date": "2026-09-16T20:06:58Z",
      "generator": {
        "date": "2026-07-22T17:48:55Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:22858-1",
      "initial_release_date": "2026-07-22T17:48:55Z",
      "revision_history": [
        {
          "date": "2026-07-22T17:48:55Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T19:18:37Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T20:06:58Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache-ivy-2.6.0-160000.1.1.noarch",
                "product": {
                  "name": "apache-ivy-2.6.0-160000.1.1.noarch",
                  "product_id": "apache-ivy-2.6.0-160000.1.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/apache-ivy@2.6.0-160000.1.1?arch=noarch\u0026upstream=apache-ivy-2.6.0-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "apache-ivy-javadoc-2.6.0-160000.1.1.noarch",
                "product": {
                  "name": "apache-ivy-javadoc-2.6.0-160000.1.1.noarch",
                  "product_id": "apache-ivy-javadoc-2.6.0-160000.1.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/apache-ivy-javadoc@2.6.0-160000.1.1?arch=noarch\u0026upstream=apache-ivy-2.6.0-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server 16.0",
                  "product_id": "SUSE Linux Enterprise Server 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-ivy-2.6.0-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:apache-ivy-2.6.0-160000.1.1.noarch"
        },
        "product_reference": "apache-ivy-2.6.0-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-ivy-javadoc-2.6.0-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:apache-ivy-javadoc-2.6.0-160000.1.1.noarch"
        },
        "product_reference": "apache-ivy-javadoc-2.6.0-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-ivy-2.6.0-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:apache-ivy-2.6.0-160000.1.1.noarch"
        },
        "product_reference": "apache-ivy-2.6.0-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-ivy-javadoc-2.6.0-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:apache-ivy-javadoc-2.6.0-160000.1.1.noarch"
        },
        "product_reference": "apache-ivy-javadoc-2.6.0-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-26032",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-26032"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The PackagerResolver of Apache Ivy is able to download online\nartifacts and to (re)package them in a format defined by a\npackager.xml file. This repackaging is done by an Ant script, which is\nstored in a subdirectory of the configured \"buildRoot\" directory. This\nsubdirectory is calculated based on modules coordinates, like the\norganisation, name or version.\n\nIf one of the coordinates contains \"../\" sequences - which are valid\ncharacters for Ivy coordinates in general- it is possible to break out\nof the configured \"buildRoot\" directory where other files can be\noverwritten.\n\nIn order to exploit this vulnerability an attacker needs to have\naccess to a packager repository and add or modify the coordinates in\nivy.xml files to have such \"../\" sequences.\n\nUsers of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:apache-ivy-2.6.0-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:apache-ivy-javadoc-2.6.0-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:apache-ivy-2.6.0-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:apache-ivy-javadoc-2.6.0-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-26032",
          "url": "https://www.suse.com/security/cve/CVE-2026-26032"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271727 for CVE-2026-26032",
          "url": "https://bugzilla.suse.com/1271727"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:apache-ivy-2.6.0-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:apache-ivy-javadoc-2.6.0-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:apache-ivy-2.6.0-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:apache-ivy-javadoc-2.6.0-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:apache-ivy-2.6.0-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:apache-ivy-javadoc-2.6.0-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:apache-ivy-2.6.0-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:apache-ivy-javadoc-2.6.0-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-22T17:48:55Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-26032"
    }
  ]
}

CVE-2026-26032 (GCVE-0-2026-26032)

Vulnerability from cvelistv5 – Published: 2026-07-15 18:49 – Updated: 2026-07-15 19:31

Title

Apache Ivy: PackagerResolver path traversal vulnerability

Summary

The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on modules coordinates, like the organisation, name or version. If one of the coordinates contains "../" sequences - which are valid characters for Ivy coordinates in general- it is possible to break out of the configured "buildRoot" directory where other files can be overwritten. In order to exploit this vulnerability an attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files to have such "../" sequences. Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-15 19:27 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/4d9dzrlnoplvywnyj…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/07/15/5

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Ivy	Affected: 2.0.0 , ≤ 2.5.3 (semver)

Credits

yudeshui of dhgate security

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-26032",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T19:27:06.913586Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T19:27:55.061Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-15T19:31:07.994Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/15/5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.ivy:ivy",
          "product": "Apache Ivy",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.5.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "yudeshui of dhgate security"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The PackagerResolver of Apache Ivy is able to download online\u003cbr\u003eartifacts and to (re)package them in a format defined by a\u003cbr\u003epackager.xml file. This repackaging is done by an Ant script, which is\u003cbr\u003estored in a subdirectory of the configured \"buildRoot\" directory. This\u003cbr\u003esubdirectory is calculated based on modules coordinates, like the\u003cbr\u003eorganisation, name or version.\u003cbr\u003e\u003cbr\u003eIf one of the coordinates contains \"../\" sequences - which are valid\u003cbr\u003echaracters for Ivy coordinates in general- it is possible to break out\u003cbr\u003eof the configured \"buildRoot\" directory where other files can be\u003cbr\u003eoverwritten.\u003cbr\u003e\u003cbr\u003eIn order to exploit this vulnerability an attacker needs to have\u003cbr\u003eaccess to a packager repository and add or modify the coordinates in\u003cbr\u003eivy.xml files to have such \"../\" sequences.\u003cbr\u003e\u003cbr\u003eUsers of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0."
            }
          ],
          "value": "The PackagerResolver of Apache Ivy is able to download online\nartifacts and to (re)package them in a format defined by a\npackager.xml file. This repackaging is done by an Ant script, which is\nstored in a subdirectory of the configured \"buildRoot\" directory. This\nsubdirectory is calculated based on modules coordinates, like the\norganisation, name or version.\n\nIf one of the coordinates contains \"../\" sequences - which are valid\ncharacters for Ivy coordinates in general- it is possible to break out\nof the configured \"buildRoot\" directory where other files can be\noverwritten.\n\nIn order to exploit this vulnerability an attacker needs to have\naccess to a packager repository and add or modify the coordinates in\nivy.xml files to have such \"../\" sequences.\n\nUsers of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-15T18:49:43.153Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/4d9dzrlnoplvywnyj9x6w84kxg7n3jyq"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Ivy: PackagerResolver path traversal vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-26032",
    "datePublished": "2026-07-15T18:49:43.153Z",
    "dateReserved": "2026-02-09T22:55:23.574Z",
    "dateUpdated": "2026-07-15T19:31:07.994Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.