Apache Cocoon CVE-2026-108089

Requires a reachable Apache Cocoon instance whose diagnostic interfaces are network-accessible - specifically endpoints that trigger cache operations and expose verbose debug logging and profiling/profile information. No authentication or user interaction is needed (PR:N/UI:N), and the advisory states all versions are affected. The primary limiting factor is deployment: exploitation depends on the Cocoon instance (and its diagnostic/debug endpoints) being exposed to the attacker's network, and the vendor's recommended mitigation is to restrict access to trusted users, implying that network-level access control fully blocks the vector. Because the product is retired with no patch, the only remediations are access restriction or migration to an alternative.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, which on paper warrants priority attention; the 7.5 base score is driven entirely by a high confidentiality impact (C:H, I:N, A:N) consistent with CWE-497 information exposure. However, the real-world signal set is weak and partly mitigating: no EPSS score, KEV status, or POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis'. No SSVC decision data (exploitation/automatable/technical impact) was supplied. The strongest mitigating factor is that this is an officially retired, unsupported product with no planned fix, meaning its production footprint and attacker interest are likely limited and targeted rather than widespread. Net assessment: a genuine unauthenticated information-disclosure exposure where present, but more of a hygiene/attack-surface issue than an urgent mass-exploitation priority - the lack of any exploitation telemetry (EPSS/KEV/POC all absent) argues against treating it as high-urgency unless a Cocoon instance is known to be internet-exposed.

A remote, unauthenticated attacker who can reach an exposed Apache Cocoon instance over the network requests its diagnostic/management endpoints and receives verbose debug logging, profiling output, and cache-control functionality that should not be publicly accessible. This leaks internal system and application information useful for reconnaissance and follow-on attacks. No public exploit code was identified in the provided data, though the low attack complexity (AC:L) means no specialized conditions are needed.