Answer in brief
CVE-2026-67615 records a High severity (CVSS 8.7) vulnerability in openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker. The current sources do not mark it as known exploited. The current feed maps Apereo Foundation/openEQUELLA (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Apereo Foundation/openEQUELLA (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Apereo Foundation/openEQUELLAgeneric | >=0 <2026.1.0 | 2026.1.0 |
Published upstream
Sep 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 29, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 22, 2026
openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/*. Attackers can bypass the class-name denylist enforced by PluginAwareObjectInputStream by nesting a serialized payload inside a java.security.SignedObject, causing the inner stream to be deserialized by a separate ObjectInputStream that does not apply the denylist, ultimately reaching a JNDI sink and enabling code execution.
Quoted source text, attributed separately from HOL analysis.