CVE-2026-109432
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection…
- Risk score
- 73/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.6%
- Published
- 19 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Camunda versions 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contain an expression injection vulnerability. An attacker can supply a malicious JUEL expression to bypass security restrictions and execute arbitrary operating-system commands.
- Affected
- {'products': ['Camunda'], 'packages': [], 'versions': ['7.24.0 < 7.24.14', '7.23.0 < 7.23.17']}
- Fix
- Upgrade to Camunda 7.24.14 or later, or 7.23.17 or later
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression inside an orQueries entry to achieve arbitrary Java reflection and invoke java.lang.Runtime.exec, resulting in operating-system command execution as the engine service user.
Last activity 19 Oct 2026. Patch Forecast updates every hour.