Apache Ranger CVE-2026-44416

Exploitation targets the plugin-schema-registry component of Apache Ranger 2.8.0 or earlier, so the attacker must be able to reach that component's interface over the network; the vendor CVSS (AV:N/AC:L/PR:N/UI:N) implies no authentication and no user interaction against a reachable instance. The key limiting factor is network exposure: Ranger is usually deployed inside a data cluster/management network, so reachability of the schema-registry endpoint from the attacker's position is the practical gatekeeper rather than any special feature flag. A second caveat is that the advisory does not explicitly confirm whether any authentication normally fronts this component, so the PR:N (unauthenticated) assumption should be verified against the specific deployment; versions 2.9.0 and later are not affected.

The signals are mixed: the CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes an easy, unauthenticated, network-reachable RCE that would normally be top-priority, yet EPSS is only 0.58% (45th percentile), there is no KEV listing, and no public PoC has surfaced - indicating that in-the-wild exploitation is not yet observed and the theoretical severity currently outpaces demonstrated activity. Ranger is typically deployed inside a data cluster rather than on the public internet, so the practical attack surface depends heavily on network segmentation; the 'network' vector is real but often reachable only from within the cluster/management network. Because a successful hit against an authorization broker undermines the access controls protecting an entire data platform, any operator running Ranger - even a mid-sized team with a modest cluster - should treat patching to 2.9.0 as urgent despite the low EPSS, while recognizing that the low probability score suggests targeted rather than mass exploitation for now. One caveat: the description names a specific component (plugin-schema-registry) whose exact exposure and whether reaching it requires prior authentication are not spelled out, so the PR:N assumption in the vendor CVSS should be verified against the actual deployment.

An attacker with network access to a Ranger deployment sends a crafted request to the plugin-schema-registry interface that specifies an attacker-controlled or gadget class name, causing Ranger to instantiate it and execute attacker code in the Ranger process context. Given AC:L and (per vendor) PR:N, the attack is low-complexity and requires no user interaction; from there the attacker can subvert authorization policies and pivot into the protected data services. No public exploit code has been identified at time of analysis.