What is the CVSS score of CVE-2026-11561?

CVE-2026-11561 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Apinizer are affected by CVE-2026-11561?

Soagen Informatics' Apinizer API management platform (versions 2026.04.0-2026.04.5) contains a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-11561?

Within 24 hours: Inventory systems running Apinizer 2026.04.0-2026.04.5 and evaluate criticality of each deployment. Within 7 days: Apply vendor-released patch to version 2026.04.6 across all affected instances. Within 30 days: Review API gateway and platform logs for exploitation attempts using the CVE identifier and confirm patch coverage across all environments.

Apinizer CVE-2026-11561

EUVD-2026-36238 CRITICAL

Improper Neutralization of Special Elements used in an Expression Language Statement (CWE-917)

2026-06-11 TR-CERT

GHSA-w4f9-4cg9-7xqx

Code Injection Apinizer

Critical

Disputed · 9.8 NVD

Severity by source

Sources disagree (Medium–Critical)

Vendor (TR-CERT) PRIMARY

MEDIUM

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

EL injection in an internet-facing API gateway is network-reachable with no auth or interaction; successful code execution yields full confidentiality, integrity, and availability impact on the host.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 12, 2026 - 10:27 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 12, 2026 - 10:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 12, 2026 - 10:22 vuln.today

cvss_changed

Severity Changed

Jun 12, 2026 - 10:22 NVD

MEDIUM CRITICAL

CVSS changed

Jun 12, 2026 - 10:22 NVD

5.3 (MEDIUM) 9.8 (CRITICAL)

Re-analysis Queued

Jun 12, 2026 - 10:22 vuln.today

cvss_changed

Severity Changed

Jun 12, 2026 - 10:22 NVD

MEDIUM CRITICAL

CVSS changed

Jun 12, 2026 - 10:22 NVD

5.3 (MEDIUM) 9.8 (CRITICAL)

Patch available

Jun 11, 2026 - 14:01 EUVD

Analysis Generated

Jun 11, 2026 - 13:17 vuln.today

DescriptionNVD

Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Technologies Software and Consulting Inc. Apinizer allows Code Injection.

This issue affects Apinizer: from 2026.04.0 before 2026.04.6.

AnalysisAI

Expression language injection in Soagen Informatics' Apinizer API management platform versions 2026.04.0 through 2026.04.5 allows remote unauthenticated attackers to inject malicious EL expressions that the server evaluates, resulting in arbitrary code execution. The flaw was reported by Turkey's national CERT (TR-CERT) and carries a CVSS 9.8 critical rating, though SSVC currently indicates no observed exploitation and no public exploit identified at time of analysis. A vendor patch is available in version 2026.04.6.

Technical ContextAI

Apinizer is an API management and gateway product from Soagen Informatics Technologies Software and Consulting Inc., commonly deployed as middleware to broker, secure, and transform API traffic. The root cause is CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement), meaning attacker-controlled input flows into an expression language evaluator (typically JSP EL, SpEL, OGNL, or MVEL in Java-based gateways) without sufficient sanitization, allowing injected expressions to be parsed and executed by the server-side runtime. EL injection in Java middleware historically yields direct method invocation on ${} or #{} contexts, bridging the gap between data input and code execution. The CPE confirms the affected product line is cpe:2.3:a:soagen_informatics_technologies_software_and_consulting_inc.:apinizer.

RemediationAI

Vendor-released patch: upgrade Apinizer to version 2026.04.6 or later, which contains the fix per the TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0365). Until the upgrade can be applied, restrict network access to the Apinizer management and API ingress interfaces to trusted source IPs via firewall or VPN - accepting that this breaks legitimate remote API consumption - and place a WAF in front of the gateway with rules blocking common expression language payloads (e.g., ${, #{, T(java.lang.Runtime), OGNL/SpEL markers), recognizing such filters can produce false positives on legitimate JSON or template traffic. Increase monitoring on the Apinizer host for unexpected child processes spawned by the Java runtime as a detective compensating control.