What is the CVSS score of CVE-2026-24713?

CVE-2026-24713 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-24713?

Within 24 hours: Identify and inventory all Apache IoTDB deployments and their versions; isolate or restrict network access to affected instances if possible. Within 7 days: Implement network segmentation and WAF rules to restrict untrusted input to IoTDB endpoints; consider disabling external-facing IoTDB services if business-critical. Within 30 days: Prepare upgrade plan to versions 1.3.7 or 2.0.7; monitor vendor security advisories for patch release and apply immediately upon availability; conduct post-patch vulnerability reassessment.

Iotdb CVE-2026-24713

CRITICAL

Improper Input Validation (CWE-20)

2026-03-09 security@apache.org

GHSA-6w48-2g9j-v9q5

Apache Iotdb

9.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send malformed input to IoTDB network interface
Exploit

Bypass input validation checks
Impact

Execute arbitrary code with database privileges

Vulnerability Assessment

Weakness	CWE CWE-20 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions	Apache IoTDB versions 1.0.0–1.3.6 or 2.0.0–2.0.6 with network accessibility enabled. No authentication required for remote exploitation against default configurations.
Impact	CVSS 9.8. Multiple attack vectors against IoT data infrastructure.
Exploit ScenarioDerived	Attacker sends crafted input to IoTDB service, exploiting validation weakness.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Input validation vulnerability in Apache IoTDB from 1.0.0 before 1.3.7 and from 2.0.0 before 2.0.7. Second critical CVE affecting the IoT database.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:56 CVSS 9.8

Input validation flaw in Apache IoTDB.

RemediationAI

Update to IoTDB 1.3.7 or 2.0.7.

Affected Packages

maven org.apache.iotdb:iotdb-core fix: 1.3.7, 2.0.7

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in maven

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-20 improper input validation. Second critical vulnerability in Apache IoTDB.

Know when Iotdb gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Mar 09, 2026 - 09:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Improper Input Validation vulnerability in Apache IoTDB.

This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.

Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.

Executive ViewAI

Why It Matters

A critical input validation vulnerability in Apache IoTDB (CVSS 9.8) affects versions 1.0.0-1.3.6 and 2.0.0-2.0.6, potentially allowing attackers to execute arbitrary code or compromise data integrity. Organizations running affected IoTDB instances face immediate risk of system compromise; however, current exploit activity is minimal (0.1% EPSS). Immediate action is required to inventory affected systems and implement interim protections pending patch availability.

Business Impact: Severe

Compensating Controls

Until vendor patch is released: (1) Implement network segmentation to restrict IoTDB access to trusted internal systems only; (2) Deploy WAF rules to validate and sanitize input to IoTDB API endpoints; (3) Disable unnecessary IoTDB features or external connectivity if operationally feasible; (4) Enable comprehensive logging and monitoring for suspicious IoTDB activity; (5) Maintain current backups and establish rapid recovery procedures; (6) Consider temporary service shutdown if no compensating controls adequately reduce risk.

Threat Intelligence Overview

EPSS Score

0.1%

Top 69% exploitable

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.