What is the CVSS score of CVE-2026-44825?

CVE-2026-44825 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Solr are affected by CVE-2026-44825?

Apache Solr versions 9.4.0-10.0.0 contain a critical authentication bypass where the auth setup tool silently provisions hardcoded default credentials, enabling unauthenticated remote attackers to…

Is there a public PoC exploit available for CVE-2026-44825?

Yes, a public proof-of-concept exploit is available for CVE-2026-44825. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-44825?

Within 24 hours: Identify and audit all Solr deployments running versions 9.4.0-10.0.0 to assess exposure; immediately restrict network access to Solr endpoints using firewall rules or network segmentation to limit connections to trusted systems only; and review access logs for unauthorized authentication attempts using default credentials (superadmin, admin, search, index). Within 7 days: Implement additional security controls including disabling or removing default accounts if the setup tool permits, enforcing strong authentication for operator-configured accounts, and deploying monitoring and alerting for authentication events on Solr instances. Within 30 days: Establish a formal plan to upgrade all affected Solr instances to patched versions when released by the vendor, continue monitoring vendor security advisories, ensure all interim compensating controls remain operational and regularly tested, and conduct a comprehensive security assessment of Solr cluster configurations.

Apache Solr CVE-2026-44825

EUVD-2026-33602 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-06-01 security@apache.org

GHSA-qhr7-h655-pw6r

Apache Authentication Bypass Solr Red Hat

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Known default credentials give network unauthenticated access (AV:N/PR:N/AC:L) yielding full admin control over the cluster, so C/I/A are all High; the config precondition affects population, not the base vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.1 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 22, 2026 - 07:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 22, 2026 - 07:22 vuln.today

cvss_changed

Severity Changed

Jul 22, 2026 - 07:22 NVD

HIGH CRITICAL

CVSS changed

Jul 22, 2026 - 07:22 NVD

8.1 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jun 01, 2026 - 09:31 vuln.today

CVE Published

Jun 01, 2026 - 09:16 nvd

HIGH 8.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

20 maven packages depend on org.apache.solr:solr-core (18 direct, 2 indirect)

Ecosystem-wide dependent count for version 9.4.0.

DescriptionNVD

Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account.

As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue.

Not affected:

Clusters where bin/solr auth enable was not used to bootstrap BasicAuth
Clusters where template users have been assigned strong passwords after bootstrap

Articles & Coverage 1

POC CVE-2026-44825: Apache Solr Velocity Template RCE Scanner and PoC Jul 08, 2026

AnalysisAI

Full administrative cluster takeover in Apache Solr 9.4.0-9.10.1 and 10.0.0 arises because the 'bin/solr auth enable' setup tool silently provisions hardcoded template accounts (superadmin, admin, search, index) with publicly known default passwords alongside the operator's chosen account. Any remote attacker who reaches the Solr endpoint can authenticate with these baked-in credentials and obtain total control of the cluster. There is no public exploit identified at time of analysis and EPSS is low (0.21%), but the CVSS 9.8 rating and 'total' SSVC technical impact make this a high-severity misconfiguration-by-default flaw.

Technical ContextAI

Apache Solr is a widely used open-source enterprise search platform built on Lucene, frequently exposed as a network service and secured via its BasicAuthPlugin, whose users and hashed credentials live in the ZooKeeper/collection security.json file. The vulnerability is a classic CWE-798 (Use of Hard-coded Credentials): the 'bin/solr auth enable' bootstrap helper writes a security.json that includes fixed template users (superadmin, admin, search, index) with well-known default passwords in addition to the user-specified administrator. Because these template accounts are documented/known and installed silently, they function as a backdoor into Solr's role-based authorization model. The affected CPEs are cpe:2.3:a:apache:solr:* (branch 9.4.0 through 9.10.1) and cpe:2.3:a:apache:solr:10.0.0.

RemediationAI

No vendor-released patch is identified at time of analysis: the fixed builds 9.11.0 and 10.1.0 are announced but not yet released, so upgrading is not currently an option and the primary control is the vendor workaround. Immediately edit the cluster's security.json to either delete the four template users (superadmin, admin, search, index) or reset each of them to a strong, unique password, then reload/restart so the change propagates through ZooKeeper - deleting them is cleaner but verify no automation or tooling depends on those account names before removing, since anything relying on them will lose access. As additional compensating controls, restrict network reachability of the Solr admin/API ports to trusted management hosts and audit BasicAuthPlugin role mappings to confirm no unexpected accounts retain admin privileges. Once released, upgrade to Apache Solr 9.11.0 or 10.1.0, which the vendor states resolves the issue outright. Track the vendor advisory at https://lists.apache.org/thread/5xg6xr99glocp3zsg9ht2zlbwlrst7ch.