Someone left the keys to the engine room on a hook inside the staff-only break room
CVE-2026-66088 is an OS command injection (CWE-78) in the openEQUELLA digital content repository, affecting all versions before 2026.1. The scripting engine exposes a system.execute() method — originally intended for invoking helper applications like video-metadata extractors — that passes caller-supplied strings directly to the operating system shell with zero validation and no allow-list of permitted executables. Any authenticated user who holds the privilege to create or edit scripts within the Administration Console's Collection Definition Editor can weaponize this to run arbitrary commands under the identity of the openEQUELLA service account. The fix in 2026.1 is presumably to sandbox or remove the dangerous method, though Apereo has not published the specific remediation detail beyond the version bump.
The CNA (Monash University MON-CSIRT) published a CVSS 4.0 base score of 9.4 Critical with PR:L (low privileges). That rating overstates the real-world risk for most defenders. In practice, script editing in openEQUELLA is confined to the Administration Console — a thick-client Java app that requires specific ACLs typically held only by institution administrators or collection administrators. This is closer to PR:H in CVSS 3.1 terms. Furthermore, openEQUELLA's installed base is small and concentrated in higher-education institutions (universities, TAFEs, government education departments), with no evidence of significant internet-facing exposure. No public exploit, no nuclei template, and no in-the-wild activity exist. The EPSS score of 0.68 % (52nd percentile) corroborates low near-term exploitation pressure. noisgate assesses this as HIGH (7.2) — serious if you run openEQUELLA, but the privilege gate and niche deployment keep it off the CRITICAL shelf.
5 steps from start to impact.
Authenticate with script-editing privileges
- Valid openEQUELLA credentials
- Script-creation or script-editing privilege (Administration Console ACL)
- Script ACLs are admin-tier by default; regular content contributors never hold them
- Account pool is typically 2–5 per institution, limiting spray-and-pray credential attacks
- MFA on the openEQUELLA login (if configured) blocks stolen-password scenarios
Open the Administration Console and access a Collection Definition
- Network connectivity to the openEQUELLA server on its HTTPS port
- Java runtime on the attacker workstation (Console is a Java fat client)
- Console requires a Java environment and direct network path — cannot be exploited via a simple HTTP request from the internet
- Many campus deployments restrict Admin Console access to the management VLAN or VPN
Inject a malicious system.execute() call into a script
system.execute('malicious_command'). The scripting engine is server-side JavaScript (Rhino/Nashorn) and the SystemScriptObject exposes execute() with no argument filtering. The script can be triggered on item contribution, save, or display — whichever event the attacker binds it to.- Write access to a collection definition's script fields
- Knowledge that system.execute() exists (documented in the Advanced Scripting Guide as the SystemScriptObject)
- Requires familiarity with openEQUELLA's scripting API — niche knowledge
- Script changes may be auditable in the collection definition history
system.execute in script bodiesTrigger the script to execute OS commands
system.execute(), which hands the command string to Runtime.exec() or ProcessBuilder running as the openEQUELLA service account. The attacker now has arbitrary command execution on the host.- At least one collection exists that uses the poisoned script
- An event that fires the script (contribution, save, display)
- If the service account is a dedicated low-privilege user (best practice), OS-level damage is constrained
- SELinux / AppArmor profiles on the Java process can block unexpected child processes
Post-exploitation and lateral movement
hibernate.properties or environment variables, exfiltrate repository content, install persistence (cron/scheduled task, SSH key), and pivot to adjacent systems on the campus network. The blast radius depends on the service account's OS-level permissions and network segmentation around the openEQUELLA host.- Service account has filesystem access to configuration files containing DB credentials
- Network path from the openEQUELLA host to other campus systems
- Well-segmented campus networks limit lateral reach
- Database credentials may use integrated auth (Kerberos) rather than stored passwords, reducing credential-harvesting value
- EDR on the host detects post-exploitation tools and lateral movement
system.execute() method. Schedule the upgrade within the noisgate remediation SLA of 180 days for HIGH severity. If your change-management process allows, pull it into your next maintenance window to eliminate the risk entirely. No backports to older branches exist, so upgrading is the only patch path.ps aux | grep equella and confirm the user is not root.java, ffmpeg for media processing). This converts a silent compromise into a detected incident. Detection does not prevent exploitation but enables rapid containment.- WAF rules on the HTTP front-end — the command injection does not travel through an HTTP request parameter; it is authored inside the Administration Console's Collection Definition Editor and stored in the database as a script body. A WAF inspecting HTTP traffic will never see the payload.
- Disabling JavaScript in end-user browsers — the scripting engine runs *server-side* (Rhino/Nashorn). Client-side JavaScript controls are irrelevant.
- Removing system.execute() from the Java classpath — the method is compiled into the openEQUELLA core; there is no standalone JAR to remove without breaking the application. Only the vendor patch in 2026.1 properly remediates it.
The supporting signals.
| In-the-wild exploitation | No evidence. Not observed by CISA KEV, OffSeq Mirage, GreyNoise, or any campaign tracker as of 29 Oct 2026. |
|---|---|
| Proof-of-concept availability | None public. No PoC on GitHub, Exploit-DB, Metasploit, or pocindex.io. No nuclei detection template indexed. The exploit is trivial to write (one-liner script call) but no researcher has published one. |
| EPSS | 0.00685 (0.68 %), 52nd percentile — below-average exploitation probability over 30 days. |
| KEV status | Not listed. No CISA KEV entry as of 29 Oct 2026. |
| CVSS 4.0 (CNA) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L → 9.4 Critical. NVD analysis pending; CNA is Monash University MON-CSIRT. PR:L is arguably generous — script editing in openEQUELLA requires Administration Console access, closer to PR:H. |
| Affected versions | All openEQUELLA releases before 2026.1 (versioning follows YYYY.minor; prior releases include 2024.1, 2024.2, 2021.1, etc.). |
| Fixed version | openEQUELLA 2026.1 (also reported as 2026.1.0). No backports to older release branches are documented. |
| Internet exposure | Negligible. No Shodan/Censys/FOFA dork results for openEQUELLA banners found. The product is primarily deployed on campus intranets or behind university SSO gateways. |
| Disclosure timeline | Reserved: 24 Jul 2026 · Published: 29 Oct 2026 · Advisory: GHSA-q8xp-w3fr-hj4v |
| Reporter / CNA | Filed by Monash University Cyber Security Incident Response Team (MON-CSIRT) as CNA. Part of a batch of six openEQUELLA CVEs (66088–66092 + 16889) disclosed simultaneously. |
Sources.
Why this verdict
- Privilege gate is admin-tier, not low-privilege. Despite the CNA's
PR:L, thesystem.execute()method is reachable only via the Collection Definition Editor inside the Administration Console — a thick-client admin tool. Regular authenticated users (students, faculty contributors) cannot create or edit scripts. The effective prerequisite is a compromised administrator account, which dramatically shrinks the attacker population. - Niche installed base limits attacker ROI. openEQUELLA is used by a small number of universities, TAFEs, and government education bodies worldwide (estimated low hundreds of deployments). There is no mass-market installed base for automated exploitation. Opportunistic attackers have far richer targets.
- No public exploit or exploitation activity. Zero PoCs on GitHub, Exploit-DB, Metasploit, or nuclei. EPSS sits at 0.68 %, 52nd percentile. No KEV listing. No campaign traffic recorded by OffSeq Mirage or GreyNoise. The threat is theoretical today.
- Network position is typically internal/campus. openEQUELLA instances are overwhelmingly behind university SSO gateways or campus VPNs. No internet-facing exposure was found via Shodan or Censys queries. An external attacker must first breach the perimeter.
- Role multiplier: openEQUELLA is a line-of-business content repository (role b). It is not an identity provider, hypervisor, CI/CD system, backup target, network edge device, or any other component in the high-value-role catalog. In role (b), a successful chain yields host-level RCE and access to stored educational content — potentially FERPA-regulated — plus pivot potential on the campus network. This is serious but bounded: the blast radius is *host → adjacent network segment*, not *domain → fleet → supply chain*. No high-value-role floor applies.
Why not higher?
The vulnerability does not reach CRITICAL because exploitation requires a compromised administrator account with a specific ACL, the product sits outside every high-value infrastructure role, and the installed base is too small to attract automated exploitation. There is no path from this bug alone to domain takeover, fleet compromise, or supply-chain impact. The absence of any public PoC, KEV listing, or exploitation signal confirms that the theoretical severity is not translating into real-world urgency.
Why not lower?
Despite the friction, the underlying flaw is unrestricted OS command injection — a top-10 CWE weakness class. If exploited, the attacker achieves full RCE on the server with the service account's privileges, can exfiltrate all repository content (potentially FERPA/GDPR-protected student and research data), harvest database credentials, and pivot laterally. The attack complexity is genuinely low once the privilege requirement is met, and the scripting API is documented. A MEDIUM rating would understate the impact to any institution that actually runs openEQUELLA in production.
Crowdsourced verification payload.
Run this script from any host with curl and network access to the openEQUELLA instance. Pass the base URL as the sole argument. No authentication or special privileges are required — the script checks the version string exposed on the login page or API. Example: bash check_cve_2026_66088.sh https://equella.campus.edu
#!/usr/bin/env bash
# CVE-2026-66088 — openEQUELLA system.execute() OS Command Injection
# Determines if the target instance runs a vulnerable version (< 2026.1).
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
set -euo pipefail
if [[ $# -lt 1 ]]; then
printf 'Usage: %s <EQUELLA_BASE_URL>\n' "$0"
printf 'Example: %s https://equella.campus.edu\n' "$0"
exit 2
fi
BASE="${1%/}"
VERSION=""
# Attempt 1: REST API status endpoint (unauthenticated on some deployments)
if command -v curl &>/dev/null; then
RAW=$(curl -skL --max-time 15 "${BASE}/api/status" 2>/dev/null || true)
VERSION=$(printf '%s' "$RAW" | grep -oP '"version"\s*:\s*"\K[0-9]+\.[0-9]+[^"]*' | head -1 || true)
fi
# Attempt 2: Scrape the login page for a version string
if [[ -z "$VERSION" ]]; then
RAW=$(curl -skL --max-time 15 "${BASE}/logon.do" 2>/dev/null || true)
VERSION=$(printf '%s' "$RAW" | grep -oiP '(?:version|ver)[:\s]*\K[0-9]{4}\.[0-9]+[^\s<"]*' | head -1 || true)
fi
# Attempt 3: Check the page footer / about endpoint
if [[ -z "$VERSION" ]]; then
RAW=$(curl -skL --max-time 15 "${BASE}/about.do" 2>/dev/null || true)
VERSION=$(printf '%s' "$RAW" | grep -oP '[0-9]{4}\.[0-9]+\.[0-9]+' | head -1 || true)
fi
if [[ -z "$VERSION" ]]; then
printf 'UNKNOWN — Could not determine openEQUELLA version at %s\n' "$BASE"
printf 'Verify the URL is correct and the instance is reachable.\n'
exit 2
fi
printf 'Detected openEQUELLA version: %s\n' "$VERSION"
MAJOR=$(printf '%s' "$VERSION" | cut -d. -f1)
MINOR=$(printf '%s' "$VERSION" | cut -d. -f2)
# Vulnerable: any version where MAJOR < 2026, or MAJOR == 2026 and MINOR < 1
if [[ "$MAJOR" -lt 2026 ]] 2>/dev/null; then
printf 'VULNERABLE — %s is before 2026.1 (CVE-2026-66088)\n' "$VERSION"
exit 1
elif [[ "$MAJOR" -eq 2026 && "$MINOR" -lt 1 ]] 2>/dev/null; then
printf 'VULNERABLE — %s is before 2026.1 (CVE-2026-66088)\n' "$VERSION"
exit 1
elif [[ "$MAJOR" -ge 2026 && "$MINOR" -ge 1 ]] 2>/dev/null; then
printf 'PATCHED — %s is 2026.1 or later\n' "$VERSION"
exit 0
else
printf 'UNKNOWN — Could not parse version "%s" for comparison\n' "$VERSION"
exit 2
fi