What is the CVSS score of CVE-2026-62392?

CVE-2026-62392 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.8%.

Which versions of Apache Kylin are affected by CVE-2026-62392?

Apache Kylin 4.0-5.0.3 (analytics engine) can be completely compromised by unauthenticated attackers with a single network request, allowing full host takeover and data theft.

How to fix or mitigate CVE-2026-62392?

Within 24 hours, identify all systems running Apache Kylin versions 4.0-5.0.3 and assess network exposure; immediately isolate or air-gap affected systems if exposed to untrusted networks. Within 7 days, either monitor Apache Kylin project advisories for patch availability or implement compensating controls, including restricting Kylin API access to trusted internal networks only, deploying Web Application Firewall (WAF) rules to block malformed job configuration parameters, and reducing Kylin service privilege levels. Within 30 days, complete migration off vulnerable versions or confirm patch availability and upgrade; validate remediation through vulnerability scanning and access log review.

Apache Kylin CVE-2026-62392

EUVD-2026-43664 CRITICAL

OS Command Injection (CWE-78)

2026-07-14

GHSA-vv75-pcv7-p758

Apache Command Injection Kylin

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable API with low-complexity command injection, but submitting job/config parameters typically requires an authenticated operator, so PR:L rather than PR:N; full C/I/A impact from OS command execution.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 17:13 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 17:07 vuln.today

cvss_changed

CVSS changed

Jul 14, 2026 - 17:07 NVD

9.8 (CRITICAL)

Analysis Generated

Jul 14, 2026 - 04:16 vuln.today

CVE Published

Jul 14, 2026 - 03:47 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical OS Command Injection in Apache Kylin Async Query API - CVE-2026-62392 Jul 14, 2026

AnalysisAI

OS command injection in Apache Kylin (versions 4 through 5.0.3) allows attackers to execute arbitrary operating-system commands by supplying malicious job configuration parameters that a backend API passes unsanitized to the OS command line. Because Kylin runs as a distributed analytics engine, successful exploitation yields full host compromise with the privileges of the Kylin service account. Per the vendor CVSS (AV:N/PR:N), the flaw is scored as network-reachable and unauthenticated with high impact across confidentiality, integrity, and availability; no public exploit is identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Apache Kylin is an open-source distributed analytics/OLAP engine (cpe:2.3:a:apache:kylin) that builds and manages cubes over big-data sources such as Hive and HBase/Spark, driving these through backend build/query jobs. The vulnerability is a CWE-78 (Improper Neutralization of Special Elements used in an OS Command) issue: a backend API takes job configuration parameters and incorporates them directly into an OS command line without proper neutralization of shell metacharacters. This means values that should be inert configuration data (a job/build parameter) are interpreted by the shell, so characters like ';', '|', '`', or '$()' let an attacker append or inject additional commands executed by the underlying operating system.

RemediationAI

Vendor-released patch: upgrade to Apache Kylin 5.0.4, which fixes the OS command injection; this is the primary and recommended remediation for all installations running versions 4 through 5.0.3. Consult the Apache advisory (https://seclists.org/oss-sec/2026/q3/135) and KYLIN-6091 (https://issues.apache.org/jira/browse/KYLIN-6091) for authoritative fix details. If immediate upgrade is not possible, restrict network access to the Kylin backend/management API so it is reachable only from trusted administrative networks or via VPN (trade-off: legitimate remote operators lose direct access), enforce strong authentication and least-privilege on accounts that can create or edit job/cube configurations (trade-off: none significant beyond administrative overhead), and monitor Kylin process execution and job-config inputs for shell metacharacters or unexpected child processes (trade-off: detective control only, does not prevent exploitation). These are compensating controls; only the 5.0.4 upgrade removes the underlying flaw.