Which versions of JasperReports Library are affected by CVE-2026-6009?

Jaspersoft JasperReports Library and Server (versions up to 7.0.6 and 10.0.0) contain a remote code execution vulnerability exploitable by authenticated users to execute arbitrary code on affected…. A patch is available.

How to fix or mitigate CVE-2026-6009?

Within 24 hours, inventory all systems running Jaspersoft JasperReports Library and Server to identify instances at or below versions 7.0.6 and 10.0.0; flag production and externally-exposed deployments for priority remediation. Within 7 days, apply the available vendor patch from Jaspersoft to all identified instances, conducting testing in non-production environments first and scheduling controlled maintenance windows for production systems to minimize disruption. Within 30 days, confirm patching completion across all environments through version verification, enable enhanced logging on patched systems to detect suspicious deserialization attempts and unusual administrative access, and document remediation timelines for compliance records.

JasperReports Library CVE-2026-6009

Q: What is the CVSS score of CVE-2026-6009?

CVE-2026-6009 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-30962 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-05-19 Jaspersoft

GHSA-9wxq-mwqw-8hhg

RCE Java Deserialization Jasperreports Server Jasperreports Web Studio Jaspersoft Jasperreports Library Community Edition Jaspersoft Studio Community Edition Jasperreports Library Professional Jaspersoft Studio Professional Jasperreports Io Professional Jasperreports Io At Scale

8.7

CVSS 4.0 · Vendor: Jaspersoft

Severity by source

Vendor (Jaspersoft) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable, low-complexity deserialization with no user interaction but requiring an authenticated session (PR:L), yielding full confidentiality, integrity, and availability impact on the host.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Jaspersoft).

CVSS VectorVendor: Jaspersoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:37 vuln.today

CVE Published

May 19, 2026 - 17:23 cve.org

HIGH 8.7

CVE Published

May 19, 2026 - 17:23 nvd

UNKNOWN (no severity yet)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

40 maven packages depend on net.sf.jasperreports:jasperreports (32 direct, 8 indirect)

Ecosystem-wide dependent count for version 7.0.7.

DescriptionCVE.org

Java Deserialisation Vulnerability in Jaspersoft Reports Library leads to Remote Code Execution (RCE), potentially allowing code execution on the affected system

AnalysisAI

Remote code execution in Jaspersoft's JasperReports Library and Server (Community and Professional editions up to 7.0.6 / 10.0.0) arises from unsafe deserialization of untrusted Java objects (CWE-502), letting an authenticated attacker run arbitrary code on the host. The flaw carries full 'total' technical impact per SSVC, and its network-reachable, low-complexity vector makes it a strong patch priority despite requiring some privileges; no public exploit identified at time of analysis, and EPSS is modest at 0.40% (61st percentile).

Technical ContextAI

JasperReports is a widely embedded Java reporting engine used both as a standalone server (JasperReports Server, IO) and as a library compiled into other Java/BI applications, plus the Jaspersoft Studio design tool. The root cause is CWE-502, Deserialization of Untrusted Data: the library reconstructs Java objects from attacker-influenced serialized input without adequately restricting the object types instantiated. When a gadget chain is present on the classpath (common in fat Java deployments with libraries like Commons-Collections), Java's native deserialization can be abused to trigger arbitrary method invocation and command execution. The affected CPEs span the community and professional library editions, the report server, IO/at-scale variants, Web Studio, and Jaspersoft Studio, confirming the vulnerable code lives in the shared reporting core rather than a single product.

RemediationAI

Patch available per vendor advisory - upgrade to the fixed release above the affected ranges (Community/Studio Community beyond 7.0.6; Professional line, Server, IO and Studio Professional beyond 10.0.0; Web Studio beyond 10.0.1); consult the Jaspersoft Security Advisory (May 19 2026) at https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-may-19-2026-jaspersoft-library-cve-2026-6009-r11/ for the exact patched version numbers, which are not enumerated in the available intelligence. Where immediate patching is not possible, reduce exposure by restricting network access to the JasperReports Server/IO endpoints to trusted internal users and placing them behind a VPN or reverse-proxy allowlist (trade-off: may break legitimate external report consumers), and by tightening account provisioning since exploitation requires an authenticated session (PR:L) - enforce least privilege and remove unused report-designer/upload permissions. If your deployment permits, apply a JVM deserialization allowlist filter (e.g., a JEP-290 ObjectInputFilter) to block untrusted gadget classes, accepting the risk that an overly strict filter can break legitimate report serialization features. Do not treat these as substitutes for the vendor patch.