PT-2026-69430

CVE-2026-44416

Published

2026-08-10

Updated

2026-08-17

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 2.9.0

Description Remote Code Execution is possible through arbitrary class instantiation within the plugin-schema-registry component. Arbitrary class instantiation occurs when an application creates an instance of a class specified by user-supplied input, which can lead to the execution of unauthorized code.

Recommendations Upgrade to version 2.9.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\'Unsafe Reflection\')

Related identifiers