Which versions of OpenKM are affected by CVE-2026-42785?

OpenKM document management systems (Community Edition ≤6.3.12, Professional Edition ≤7.1.47) contain a remote code execution vulnerability in the administrative scripting interface; publicly…

Is there a public PoC exploit available for CVE-2026-42785?

Yes, a public proof-of-concept exploit is available for CVE-2026-42785. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-42785?

Within 24 hours: Identify all OpenKM Community Edition 6.3.12 and earlier, and Professional Edition 7.1.47 and earlier instances in your environment; restrict network access to the /admin/Scripting endpoint to dedicated administrative networks only; enable audit logging for all administrator activities. Within 7 days: Deploy Web Application Firewall or network filtering rules blocking requests to /admin/Scripting with action=Evaluate parameters; review and alert on all admin account access logs for suspicious scripting activity. Within 30 days: Monitor OpenKM security advisories for patch availability; develop and test an upgrade plan for Professional Edition deployments; evaluate Community Edition discontinuation if vendor patches are not released within 90 days.

OpenKM CVE-2026-42785

Q: What is the CVSS score of CVE-2026-42785?

CVE-2026-42785 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-31835 HIGH

Code Injection (CWE-94)

2026-05-26 VulnCheck

GHSA-w8q9-g33h-9x9m

RCE Java Code Injection Openkm Openkm Community Edition Openkm Professional Edition

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:01 vuln.today

CVSS changed

May 26, 2026 - 15:22 NVD

7.2 (HIGH) 8.6 (HIGH)

DescriptionCVE.org

OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system commands in the context of the OpenKM application server.

AnalysisAI

Remote code execution in OpenKM Community Edition (≤6.3.12) and Professional Edition (≤7.1.47) allows authenticated administrators to execute arbitrary Java/BeanShell code via the /admin/Scripting endpoint using the action=Evaluate parameter. Publicly available exploit code exists (Exploit-DB 52520 and a Nuclei template from Terra System Labs), though no active exploitation has been confirmed in CISA KEV; EPSS sits at 0.42% (62th percentile), reflecting moderate-but-not-widespread interest.

Technical ContextAI

OpenKM is an open-source enterprise document management system written in Java that runs inside a servlet container (commonly Tomcat) and exposes an administrative scripting console at /admin/Scripting. The console is designed to evaluate BeanShell snippets - a Java-syntax scripting language with full access to the JVM, classpath, and Runtime.exec - which is a textbook CWE-94 (Improper Control of Generation of Code, 'Code Injection') scenario where attacker-controlled input is fed directly to a script interpreter. The CPE strings cpe:2.3:a:openkm:openkm_community_edition and cpe:2.3:a:openkm:openkm_professional_edition confirm both the free and commercial product lines share the vulnerable scripting feature, and because BeanShell executes within the OpenKM JVM, any command runs with the privileges of the application server account (often the tomcat user or, in the official openkm/openkm-ce Docker image, root inside the container).

RemediationAI

No vendor-released patch identified at time of analysis - the provided references include the vendor site and third-party advisories but do not name a fixed Community or Professional Edition build, so operators should monitor https://www.openkm.com/ and the Terra System Labs and VulnCheck advisories for a patched release announcement. As compensating controls, restrict network reachability of the /admin/Scripting endpoint at a reverse proxy or WAF (block or allowlist by source IP), since the feature is rarely needed in production and disabling it does not affect end-user document workflows; rotate and harden all administrator passwords, enforce MFA on the admin role if the deployment supports it, and audit existing admin accounts for unused or shared credentials. Where the scripting console is genuinely required, isolate the OpenKM host on a management VLAN and log every POST to /admin/Scripting with action=Evaluate for SOC review - the trade-off of fully blocking the endpoint is loss of administrative scripting/automation, which most installations will not miss.