What is the CVSS score of CVE-2026-24343?

CVE-2026-24343 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-24343?

Within 24 hours: Identify and inventory all Apache HertzBeat deployments, determine affected versions, and assess whether systems are internet-facing or accessible to untrusted networks. Within 7 days: Implement network segmentation to restrict access to HertzBeat instances and deploy WAF rules to block XPath injection payloads if available. Within 30 days: Upgrade to Apache HertzBeat version 1.8.0 or later once patches are released, or migrate to alternative monitoring solutions if patching timeline is unacceptable.

Hertzbeat CVE-2026-24343

HIGH

Improper Neutralization of Data within XPath Expressions ('XPath Injection') (CWE-643)

2026-02-10 security@apache.org

Apache Hertzbeat

8.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate to HertzBeat application
Exploit

Inject malicious XPath expression in input field
Execution

Execute arbitrary XPath query
Impact

Access sensitive data in XML structure

Vulnerability Assessment

Weakness	CWE CWE-643 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization XPath expression sanitization
Exploitation Conditions	Authenticated user account required; XPath query injection point must exist in HertzBeat 1.7.1 through 1.7.x versions before 1.8.0; application must process user input within XPath expressions without proper sanitization.
Impact	CVSS 8.8 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None.
Exploit ScenarioDerived	An attacker could exploit this vulnerability to compromise the affected system.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Apache HertzBeat versions 1.7.1 through 1.8.0 contain an XPath injection vulnerability that allows authenticated attackers to manipulate XPath queries and potentially extract or modify sensitive data. An attacker with valid credentials can exploit this flaw to bypass access controls and execute arbitrary XPath expressions against the application's XML data stores. Affected users should upgrade to version 1.8.0 immediately as no patch is currently available for earlier versions.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:02 CVSS 8.8

Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: from 1.7.1 before 1.8.0. [CVSS 8.8 HIGH]

RemediationAI

Update to version 1.8.0 or later. Restrict network access to the affected service where possible.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Affects Hertzbeat. Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat.

This issue affects Apache HertzBeat: from 1.7.1 before 1.8.0.

Users are recommended to upgrade to version 1.8.0, which fixes the issue.

Know when Hertzbeat gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat.

This issue affects Apache HertzBeat: from 1.7.1 before 1.8.0.

Users are recommended to upgrade to version 1.8.0, which fixes the issue.

Executive ViewAI

Why It Matters

Apache HertzBeat versions 1.7.1 through 1.8.0 contain an XPath injection vulnerability that could allow attackers to bypass authentication, extract sensitive data, or execute unauthorized actions within monitoring systems. Organizations using affected versions face immediate risk of data compromise and potential operational disruption to their monitoring infrastructure.

Business Impact: High

Compensating Controls

Implement strict network access controls limiting HertzBeat connectivity to trusted internal networks only; disable XPath-based query features if supported by configuration; deploy Web Application Firewall (WAF) rules to detect and block XPath injection attack patterns; monitor for suspicious XPath syntax in application logs and authentication attempts; consider temporary isolation of affected HertzBeat instances until patched version is available.

Threat Intelligence Overview

EPSS Score

0.0%

Top 93% exploitable

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Affected Products (CPE)CVE.org

cpe:2.3:a:apache:hertzbeat:*:*:*:*:*:*:*:*

More in Hertzbeat

View all

CVE-2024-42361 CRITICAL Act Now POC

9.8 Aug 20

Hertzbeat is an open source, real-time monitoring system. Rated critical severity (CVSS 9.8), this vulnerability is remo

CVE-2024-42323 HIGH This Week POC

8.8 Sep 21

SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating). Rated high severity (CVSS 8.8), t

CVE-2024-42362 HIGH This Week POC

8.8 Aug 20

Hertzbeat is an open source, real-time monitoring system. Rated high severity (CVSS 8.8), this vulnerability is remotely

CVE-2023-51387 HIGH This Week POC

8.8 Dec 22

Hertzbeat is an open source, real-time monitoring system. Rated high severity (CVSS 8.8), this vulnerability is remotely

CVE-2023-51650 HIGH This Week POC

7.5 Dec 22

Hertzbeat is an open source, real-time monitoring system. Rated high severity (CVSS 7.5), this vulnerability is remotely

CVE-2024-45505 HIGH This Week

8.8 Nov 18

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache HertzBeat (i

CVE-2024-41151 HIGH This Week

8.8 Nov 18

Deserialization of Untrusted Data vulnerability in Apache HertzBeat. Rated high severity (CVSS 8.8), this vulnerability

CVE-2024-45791 HIGH This Week

7.5 Nov 18

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HertzBeat.6.1. Rated high severity (C

CVE-2024-56736 MEDIUM This Month

6.5 Apr 16

Server-Side Request Forgery (SSRF) vulnerability in Apache HertzBeat.7.0. Rated medium severity (CVSS 6.5), this vulnera

CVE-2025-48208 HIGH This Month

8.8 Sep 09

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache HertzBeat .

CVE-2025-24404 HIGH This Month

8.8 Sep 09

XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat. Rated high severity (CVSS 8.8),

Same weakness CWE-643 – Improper Neutralization of Data within XPath Expressions ('XPath Injection')

View all

CVE-2026-44962 CRITICAL

9.9

CVE-2025-11844 MEDIUM POC

5.4

CVE-2024-2648 MEDIUM POC

5.3

CVE-2024-2645 MEDIUM POC

5.3

CVE-2026-9390 CRITICAL

9.1

CVE-2024-39565 HIGH

7.7

CVE-2026-40699 HIGH

7.1

CVE-2026-11864 MEDIUM

6.5

References

Advisories & patches

ADVISORY https://lists.apache.org/thread/b2k3jqwffrbo2sy6bl4n0f68kp8bfo1n REF http://www.openwall.com/lists/oss-security/2026/02/09/4

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back