What is the CVSS score of CVE-2026-40008?

CVE-2026-40008 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Apache IoTDB are affected by CVE-2026-40008?

Apache IoTDB versions 1.0.0-2.0.9 contain a critical remote code execution vulnerability in the pipe processor that enables arbitrary Java class instantiation, potentially allowing attackers to…. A patch is available.

How to fix or mitigate CVE-2026-40008?

Within 24 hours: Audit all Apache IoTDB instances and document current versions in inventory. Within 7 days: Upgrade to Apache IoTDB 2.0.10 across all environments, testing in non-production first. Within 30 days: Verify all instances are running 2.0.10 or later; monitor access logs for signs of exploitation attempts.

Apache IoTDB CVE-2026-40008

EUVD-2026-42836 CRITICAL

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE-470)

2026-07-10 apache

GHSA-v4p4-86j5-2f8q

Java Information Disclosure Apache Apache Iotdb

9.8

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

9.8 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable and low-complexity, but defining a pipe processor is an authenticated operation so PR:L; unsafe reflection yields code execution with full CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 10, 2026 - 15:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 10, 2026 - 15:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 10, 2026 - 15:22 vuln.today

cvss_changed

Severity Changed

Jul 10, 2026 - 15:22 NVD

HIGH CRITICAL

CVSS changed

Jul 10, 2026 - 15:22 NVD

9.8 (HIGH) 9.8 (CRITICAL)

Patch available

Jul 10, 2026 - 09:16 EUVD

Analysis Generated

Jul 10, 2026 - 08:23 vuln.today

DescriptionCVE.org

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting.

This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.

Users are recommended to upgrade to version 2.0.10, which fixes the issue.

Articles & Coverage 3

News 8 New Apache Vulnerabilities - 3 Critical, 5 High Severity Jul 11, 2026 News 6 New Apache Vulnerabilities - 6 High Severity, 1 With POC Jul 10, 2026 News 3 New Java Vulnerabilities - 2 Critical, 1 High Severity Jul 10, 2026

AnalysisAI

Unsafe reflection in Apache IoTDB's pipe processor lets a user-supplied fully qualified Java class name be loaded and instantiated via Class.forName().newInstance() with no allowlisting, enabling arbitrary class loading and likely remote code execution in the database server process. It affects all releases from 1.0.0 up to (but not including) 2.0.10 and is fixed in 2.0.10. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach IoTDB pipe interface

Delivery

Submit pipe with malicious class name

Exploit

Server calls Class.forName().newInstance()

Execution

Constructor/static initializer runs in JVM

Impact

Code execution as IoTDB process

Access

Reach IoTDB pipe interface

Delivery

Submit pipe with malicious class name

Exploit

Server calls Class.forName().newInstance()

Execution

Constructor/static initializer runs in JVM

Impact

Code execution as IoTDB process

Vulnerability AssessmentAI

Exploitation	Exploitation requires the ability to configure a pipe processor in Apache IoTDB - specifically supplying a fully qualified Java class name that the pipe subsystem loads via Class.forName().newInstance(). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals conflict and should be weighed rather than taken at face value. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with the ability to define or modify a pipe in IoTDB creates a pipe whose processor is set to an attacker-chosen fully qualified class name; when IoTDB instantiates it via Class.forName().newInstance(), the class's constructor or static initializer runs inside the database JVM, giving code execution with the server's privileges. Because the flaw is low-complexity and the input is directly reflected, exploitation is reliable once the pipe-configuration path is reachable, though no public POC is currently known.
Remediation	Vendor-released patch: 2.0.10 - upgrade Apache IoTDB to 2.0.10, which adds validation/allowlisting to the pipe processor class loading, per the Apache advisory (https://lists.apache.org/thread/fm8cpvzbox2qqy99ztglm8wkk1nrg9ng). … Detailed patch versions, workarounds, and compensating controls in full report.