What is the CVSS score of CVE-2026-28672?

CVE-2026-28672 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of Apache Ranger are affected by CVE-2026-28672?

Apache Ranger 0.6-2.8 contains an unauthenticated remote command injection vulnerability (CVE-2026-28672, CVSS 9.8) allowing attackers to achieve full system compromise without credentials.

How to fix or mitigate CVE-2026-28672?

Within 24 hours: Inventory all Apache Ranger deployments running versions 0.6-2.8 and categorize by network exposure (Internet-facing vs. internal-only). Within 7 days: Implement firewall rules restricting Ranger access to authenticated internal systems and authorized users only; disable external-facing management APIs if not operationally required; enable comprehensive application-level logging on all Ranger instances to capture access attempts and command execution. Within 30 days: Monitor Apache Ranger security advisories for patch availability and apply immediately upon release; if no patch emerges within 30 days, execute an immediate upgrade to an unaffected version or transition to an alternative data governance platform; conduct forensic audit of all Ranger systems to detect evidence of prior unauthorized access.

Apache Ranger CVE-2026-28672

EUVD-2026-55254 CRITICAL

Command Injection (CWE-77)

2026-08-10 apache

GHSA-6qc3-v8fv-fv9j

Apache Command Injection Apache Ranger Apache Software Foundation

9.8

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

9.8 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Aligned with NVD as a network command-injection RCE with full CIA impact; PR:N retained per available data but flagged as unverified since Ranger admin APIs typically require authentication.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 12, 2026 - 16:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 12, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Aug 12, 2026 - 16:22 NVD

9.8 (CRITICAL)

Analysis Generated

Aug 10, 2026 - 11:09 vuln.today

DescriptionCVE.org

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger.

This issue affects Apache Ranger: from 0.6 through 2.8.

AnalysisAI

Command injection in Apache Ranger versions 0.6 through 2.8 allows attackers to inject and execute operating-system commands through improperly neutralized special elements (CWE-77), yielding full compromise of the host running the Ranger service. The NVD CVSS vector scores it 9.8 (network, low complexity, no privileges, no user interaction) with high confidentiality, integrity, and availability impact, meaning a successful exploit can read, alter, and destroy data on the affected component. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS estimates a 1.01% 30-day exploitation probability (60th percentile).

Technical ContextAI

Apache Ranger is the centralized authorization, access-control, and data-governance framework for the Hadoop/big-data ecosystem, mediating fine-grained policies for services such as HDFS, Hive, HBase, Kafka, and YARN. The root cause is CWE-77, Improper Neutralization of Special Elements used in a Command: user- or request-supplied input is passed into an OS command context (for example a shell invocation, script execution, or process builder) without adequate sanitization or argument separation, so crafted input can break out of the intended argument and append attacker-controlled commands. The single CPE provided (cpe:2.3:a:apache_software_foundation:apache_ranger:*) does not pin a fixed build, but the EUVD version range establishes the vulnerable envelope as Ranger 0.6 up to and including 2.8. Because Ranger typically runs as a privileged, network-exposed admin/policy service, command execution on it can pivot into the broader data platform it governs.

RemediationAI

Upgrade Apache Ranger to a fixed release beyond the affected 0.6-2.8 range as directed by the Apache advisory at https://lists.apache.org/thread/99ysjqcmz950o3jgm6pqx1wb696onzq7; the exact patched version number is not present in the available intelligence, so confirm the fixed build directly from that advisory before scheduling the change (do not assume a version). No vendor-released patch version is independently confirmed from the provided data. Until the upgrade is applied, reduce exposure with concrete compensating controls: restrict network access to the Ranger Admin service and its REST APIs to a management VLAN or a small allowlist of trusted hosts (trade-off: may break integrations that call Ranger APIs from other subnets), place the admin console behind a reverse proxy or WAF and enforce authentication/MFA on all Ranger endpoints (trade-off: added operational friction and possible tooling breakage), and audit and monitor Ranger process/host logs for anomalous shell or process-spawn activity indicative of command injection. Because Ranger commonly runs with elevated privileges, also verify it is not running as root where avoidable to limit post-exploitation impact.