Apache Ranger CVE-2026-28672

The description states only that input used in a command context is improperly neutralized, without naming the specific endpoint, parameter, or feature; the exact affected function is not disclosed in available data. The NVD CVSS vector implies remote, low-complexity, no-privilege, no-interaction exploitation against the Ranger service, which would mean no special configuration is required - but this is unverified against the vendor advisory, and Apache Ranger's command-affected surfaces are typically its authenticated admin/policy APIs, so realistic exploitation most plausibly requires network reach to the Ranger Admin service and possibly an authenticated session. Limiting factors that reduce real-world risk: Ranger admin endpoints are usually not internet-exposed and often sit behind authentication and network segmentation, and only versions 0.6 through 2.8 are in scope. Confirm the true privilege and reachability requirements with the Apache advisory before treating this as unauthenticated-against-default.

The signals are mixed and warrant judgment rather than reflexive escalation. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) describes a worst-case unauthenticated remote RCE, which on its face is a drop-everything priority; however, Apache Ranger's exploitable surfaces are predominantly its administrative and policy-management APIs, which in most deployments sit behind authentication, so the PR:N (no privileges) rating should be independently verified against the vendor advisory before it is trusted - command-injection flaws in Ranger have historically required an authenticated admin context, and if that holds here the practical exploitability is materially lower than 9.8 suggests. EPSS is modest at 1.01% (60th percentile), the CVE is NOT in CISA KEV, and no POC is referenced, so there is currently no evidence of active or automated exploitation; the picture is a high theoretical impact with low observed exploitation. That said, Ranger governs access to entire data lakes, so the blast radius of a real exploit is severe, and any organization running an internet- or broadly-network-reachable Ranger admin endpoint should treat patching as urgent regardless of the low EPSS. Net assessment: genuinely high-severity by impact and worth prioritized remediation, but the unauthenticated-network premise is the single load-bearing assumption and should be confirmed with Apache before assuming default-configuration mass-exploitability.

An attacker with network reach to the Apache Ranger service sends a crafted request whose parameter contains shell metacharacters that escape the intended argument and append an OS command; because input is not neutralized (CWE-77), the injected command runs in the context of the Ranger process. The attacker uses this to execute code on the Ranger host and then pivot into the Hadoop data platform Ranger governs. No public POC is currently identified, so an attacker would need to develop the exploit independently.