Which versions of Dotcms are affected by CVE-2026-16337?

dotCMS versions 21.02 through 26.06.22-03 contain a critical privilege escalation vulnerability allowing any authenticated backend user to elevate to administrator access and execute arbitrary code…

How to fix or mitigate CVE-2026-16337?

Within 24 hours, inventory all dotCMS installations and versions; restrict backend user access to only authorized personnel and review recent backend account creation logs. Within 7 days, contact dotCMS vendor regarding patch timeline and inquire about the status of upstream fix PR #36344; implement network segmentation to restrict access to ToolGroupResource and RoleAjax endpoints to administrators only; enable comprehensive audit logging for role assignments, layout changes, and OSGi bundle uploads. Within 30 days, be prepared to apply any released patch immediately or evaluate manual application of the upstream PR if no official release is available; prioritize this as a critical infrastructure change.

Dotcms CVE-2026-16337

Q: What is the CVSS score of CVE-2026-16337?

CVE-2026-16337 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-46076 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-20 dotCMS

GHSA-wh8m-xg73-3924

RCE Privilege Escalation Dotcms

9.4

CVSS 4.0 · Vendor: dotCMS

Severity by source

Vendor (dotCMS) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (dotCMS) · only source for this CVE.

CVSS VectorVendor: dotCMS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 20, 2026 - 20:17 vuln.today

Analysis Generated

Jul 20, 2026 - 20:17 vuln.today

CVE Published

Jul 20, 2026 - 19:15 cve.org

CRITICAL 9.4

DescriptionCVE.org

Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-assign the administrative layout and self-grant the CMS Administrator role, then achieve remote code execution via a crafted OSGi bundle upload whose BundleActivator executes arbitrary shell commands.

AnalysisAI

Privilege escalation to remote code execution in dotCMS 21.02 through 26.06.22-03 lets a low-privileged authenticated backend user abuse improper authorization checks in the ToolGroupResource (REST) and RoleAjax (DWR) endpoints to self-assign the administrative layout and self-grant the CMS Administrator role, then upload a crafted OSGi bundle whose BundleActivator runs arbitrary shell commands on the host. The endpoints failed to verify the caller was an admin before honoring layout- and role-assignment requests, so any backend account could bootstrap itself to full administrator. There is no public exploit identified at time of analysis, but an upstream fix (PR #36344) is available and the vendor-supplied CVSS 4.0 score is 9.4 (Critical).