cvesecurityvulnerability
CVE-2026-19135: OpenNMS JEXL Measurement Sandbox Bypass
A JEXL sandbox bypass in the OpenNMS Measurements REST API lets a low-privileged authenticated user load arbitrary Java classes on the server (CVSS 5.4, CWE-470). Upgrade to Horizon 36.0.3, Meridian 2024.3.12, or Meridian 2025.0.9.
