CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-109432 — Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression i...

·Source: NIST NVD

Updated:

Executive Summary

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression ins

Analysis

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression inside an orQueries entry to achieve arbitrary Java reflection and invoke java.lang.Runtime.exec, resulting in operating-system command execution as the engine service user. CVSS Score: 9.8. Published: 2026-10-19T16:17:02.487.

Indicators of Compromise (1)

CVE (1)
CVE-2026-109432
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 19, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Quest Diagnostics Reports Hack on IT System Used by Clients

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/quest-diagnostics-reports-hack-on-system-used-by-clients-image_small-9-a-33185.jpg" align=right hspace=4><b>Medical Testing Lab Told SEC Incident Likely Compromised 'Certain Patient Records'</b><br>Medical testing company Quest Diagnostics has told the U.S. Securities and Exchange Commission that it's responding to a cyber inciden

Bank Info Security
MEDIUMVulnerabilityNEW

Alms For the Cyber Poor: Program Will Help Small Utilities

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/alms-for-cyber-poor-program-will-help-small-utilities-image_small-5-a-33186.jpg" align=right hspace=4><b>Dragos Has Learned That 'Free' Doesn't Always Mean 'Usable'</b><br>Dragos, a pioneer in the operational technology security market, and its new backer, consulting giant Accenture, are teaming up with the Sans Institute training

Bank Info Security
MEDIUMVulnerability

Railway warns devs to rotate secrets after potential breach

Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. [...]

BleepingComputer