CVE-2026-78674
The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated…
- Risk score
- 53/100
- CVSS
- 8.8 v3.1
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product's r…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.8 high
References
Original description
The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product's runtime account. The scope of potential damage is contingent upon the permissions assigned to this account.
Last activity 28 Oct 2026. Patch Forecast updates every hour.