OpenNMS Meridian CVE-2026-19135

Exploitation requires a valid low-privileged OpenNMS account - the CVSS vector PR:L confirms authentication is mandatory. The Measurements REST API must be reachable by the attacker, which is the case for any user with network access to the OpenNMS web interface. No special configuration beyond a standard OpenNMS deployment is needed, as the JEXL measurement filter (with Math, StrictMath, and TreeBasedTable whitelisted) is part of the default installation. Exploitation is limited to authenticated users only (PR:N does not apply); unauthenticated exploitation is not possible. Internet-exposed deployments violate the vendor's stated deployment model but would expand the attacker pool. The attack does not require any specific OS or database configuration.

The vendor-assigned CVSS base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) significantly understates practical impact. The C:L/I:L ratings conflict with the demonstrated ability to call Class.forName('java.lang.Runtime') - arbitrary class loading in a JVM server process realistically yields OS-level command execution, implying C:H/I:H/A:H rather than C:L/I:L. The S:U (unchanged scope) rating is defensible if exploitation stays within the JVM process boundary, but is conservative given unrestricted class loading. The CVSS AV:N/AC:L/PR:L metrics correctly capture that any authenticated user can reach the Measurements REST API over the network with no special configuration. No EPSS data was provided. No KEV listing and no public exploit code have been identified, so real-world active exploitation is unconfirmed. The vendor explicitly notes OpenNMS is intended for deployment inside private networks, which is a meaningful architectural mitigating factor: internet-exposed instances are out-of-specification but would face higher risk. Overall, internal threat actors or compromised low-privileged accounts represent a credible exploitation path warranting urgent patching despite the conservative CVSS rating.

An authenticated low-privileged OpenNMS user submits a crafted JEXL expression such as table.getClass().forName('java.lang.Runtime') to the Measurements REST API. Because the sandbox incorrectly authorizes the forName call against the whitelisted TreeBasedTable class rather than java.lang.Class, the sandbox permits the call and the JVM loads the requested class, granting the attacker access to runtime execution primitives and potentially full server compromise. The regression tests included in PR #8754 document the exact expression patterns that constituted the bypass, serving as functional POC documentation even though no standalone exploit tool has been published.