Apache Ranger CVE-2026-32227

The record asserts network-reachable, low-complexity exploitation with no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N), which would mean exploitation against a Ranger deployment whose Admin/REST tier is reachable by the attacker. The concrete prerequisite is network access to the vulnerable Ranger Admin endpoint that processes the injectable parameter; the exact endpoint/feature is not named in the available data. Limiting factors: the source description omits affected versions and does not identify the vulnerable component, and the claimed PR:N (unauthenticated) conflicts with Ranger's typical authenticated Admin tier - if the real vulnerable endpoint requires a valid Ranger login, exploitation is limited to authenticated users, so this must be confirmed against the Apache advisory before assuming pre-auth reachability.

Signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes an unauthenticated, low-complexity, network-reachable attack with total impact - a textbook critical. However, EPSS is low at 0.21% (12th percentile), there is no KEV listing and no public exploit identified, indicating that real-world exploitation is not currently observed and may be theoretical or would require attacker development. There is a notable conflict to verify: many Ranger SQLi issues historically reside behind the authenticated Admin/REST tier, yet this record asserts PR:N (unauthenticated); the description is too sparse to confirm that the vulnerable endpoint is genuinely reachable pre-authentication - verify with the Apache advisory. Additionally, the affected-version field in the description is literally blank ('This issue affects .'), so the exposure window cannot be independently confirmed. Net: treat as high-priority to patch given the criticality and centrality of Ranger, but the low EPSS and absent exploit suggest this is not yet under active mass exploitation.

An attacker with network access to the Ranger Admin interface sends a crafted request containing malicious SQL in a vulnerable parameter, causing the backend to execute attacker-controlled queries. This lets them dump policy and credential data, tamper with authorization policies to grant themselves access across the Hadoop cluster, or drop tables to disrupt governance. No public exploit is identified at this time, so an attacker would need to develop the payload; the low attack complexity (AC:L) suggests this is straightforward once the vulnerable endpoint is located.