Which versions of Apache Accumulo are affected by CVE-2026-62764?

Apache Accumulo versions 2.1.4 and 2.1.5 contain a privilege enforcement flaw that allows any authenticated user with basic permissions to remotely shut down critical cluster services (manager,…

How to fix or mitigate CVE-2026-62764?

Within 24 hours, identify all systems running Apache Accumulo 2.1.4 or 2.1.5 and assess exposure within your environment. Within 7 days, procure and schedule the upgrade to version 2.1.6, which contains the vendor-released patch. Complete the migration to 2.1.6 within 30 days, testing failover and recovery procedures in a staging environment before production deployment.

Apache Accumulo CVE-2026-62764

Q: What is the CVSS score of CVE-2026-62764?

CVE-2026-62764 has a CVSS 4.0 base score of 5.7 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:L/U:Green. EPSS exploitation probability: 0.3%.

EUVD-2026-45154 MEDIUM

Improper Handling of Insufficient Privileges (CWE-274)

2026-07-17

GHSA-jqcf-97x5-2qc4

Denial Of Service Apache Accumulo

5.7

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.7 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:L/U:Green

vuln.today AI

6.5 MEDIUM

Network-exploitable by any authenticated low-privileged user with no user interaction; availability-only impact (graceful shutdown); no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jul 17, 2026 - 09:22 NVD

5.7 (MEDIUM)

Analysis Generated

Jul 17, 2026 - 06:16 vuln.today

CVE Published

Jul 17, 2026 - 06:08 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Privilege enforcement failure in Apache Accumulo 2.1.4 and 2.1.5 allows any authenticated low-privileged user - one without system-level permissions - to remotely trigger graceful shutdown of critical cluster services including the manager, tserver, gc, compactor, compaction-coordinator, monitor, and sserver. The result is a denial of service against the distributed data store, disrupting availability for all cluster consumers until an administrator manually restarts the affected components. No public exploit has been identified at time of analysis; a vendor-released fix is available in version 2.1.6.

Technical ContextAI

Apache Accumulo is a sorted, distributed key/value store built on Apache Hadoop HDFS for data persistence and Apache ZooKeeper for cluster consensus, designed for petabyte-scale data management. The vulnerable artifact is org.apache.accumulo:accumulo-server-base, the shared server-side library that mediates inter-service RPC communication and administrative control commands across Accumulo's distributed components. The root cause is improper privilege validation: the shutdown command handler processes requests from any authenticated user without verifying that the caller holds the required Accumulo SYSTEM-level permission. This maps to the general class of improper authorization or improper privilege management (analogous to CWE-269/CWE-285), where an administrative action is reachable by insufficiently privileged principals. The affected services - compaction-coordinator, compactor, gc, manager, monitor, tserver, and sserver - together constitute the operational backbone of an Accumulo cluster; shutting any of them down degrades or halts cluster availability.

RemediationAI

Upgrade to Apache Accumulo 2.1.6, the current Long-Term Maintenance release, which directly addresses this privilege enforcement failure. Binaries and sources are available at https://accumulo.apache.org/downloads/ and release notes at https://accumulo.apache.org/release/accumulo-2.1.6/. As compensating controls pending upgrade: restrict Accumulo client access at the network layer by firewalling the Accumulo RPC ports to trusted administrative hosts only - this prevents low-privileged remote users from reaching the shutdown endpoint, at the cost of limiting legitimate remote client operations. Additionally, audit and remove unnecessary Accumulo user accounts to reduce the set of principals capable of exploiting this path; the trade-off is operational overhead in user lifecycle management. Note that these controls reduce exposure but do not eliminate the underlying vulnerability - upgrading to 2.1.6 remains the authoritative fix.