Which versions of ArcadeDB are affected by CVE-2026-76224?

ArcadeDB Gremlin deployments through version 26.7.3 enable any authenticated database user-including read-only accounts-to achieve remote code execution and seize full server control via a…. A patch is available.

How to fix or mitigate CVE-2026-76224?

Within 24 hours: Inventory all ArcadeDB deployments running version 26.7.3 or earlier and immediately revoke or disable all non-essential database accounts, particularly read-only user credentials. Restrict access to administrative and mission-critical personnel only. Within 7 days: Deploy comprehensive query logging to all ArcadeDB instances with automated alerting for Groovy execution patterns (Runtime.getRuntime, ProcessBuilder, System.exec, java.lang.ProcessBuilder). Implement network segmentation to isolate ArcadeDB systems from general-user networks and untrusted interfaces. Within 30 days: Contact ArcadeDB vendor support for patched version roadmap and interim guidance; establish mandatory credential rotation schedules; audit and enforce least-privilege database role assignments. Begin evaluation of alternative database solutions if patch availability remains uncertain beyond 60 days.

ArcadeDB CVE-2026-76224

Q: What is the CVSS score of CVE-2026-76224?

CVE-2026-76224 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-62465 HIGH

Code Injection (CWE-94)

2026-08-19 VulnCheck

GHSA-qf82-gwmv-gc98

RCE Java Code Injection Arcadedb Arcadedata

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-reachable API, any authenticated role sufficient (PR:L), and Groovy OS command execution escapes the database application boundary to the host OS, warranting S:C with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 19, 2026 - 15:17 EUVD

Analysis Generated

Aug 19, 2026 - 14:48 vuln.today

CVE Published

Aug 19, 2026 - 14:02 cve.org

HIGH 8.7

DescriptionCVE.org

ArcadeDB before 26.8.1 (arcadedb-gremlin, affected <= 26.7.3) contains a remote code execution vulnerability in its Gremlin query engine. Although the engine defaults to the documented-secure java (gremlin-lang) engine, ArcadeGremlin.executeStatement() silently falls back to the insecure Groovy engine whenever a request carries any query parameter and the query does not parse as gremlin-lang. An authenticated user with any database role, including a read-only reader, can submit a parameterized Gremlin query to trigger the Groovy fallback and execute arbitrary operating system commands as the ArcadeDB server process user.

AnalysisAI

Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version 26.7.3 to full OS command execution by any authenticated user, including those with only read-only database roles. The flaw is a silent fallback in ArcadeGremlin.executeStatement() that routes parameterized queries failing gremlin-lang parsing to the unrestricted Groovy scripting engine, which can invoke arbitrary Java and OS-level code as the server process user. No public exploit has been identified at time of analysis, but the minimal privilege bar - any valid credential - makes this a critical upgrade priority for all ArcadeDB deployments.

Technical ContextAI

ArcadeDB (CPE: cpe:2.3:a:arcadedata:arcadedb:*:*:*:*:*:*:*:*) is a multi-model database exposing a Gremlin graph traversal API backed by two evaluator engines: the documented-secure gremlin-lang Java engine and the Groovy scripting engine. Groovy is an unrestricted JVM scripting runtime that permits direct invocation of Java's Runtime.exec() and ProcessBuilder, making it inherently unsafe as a query evaluator in a database context. CWE-94 (Code Injection) is the root cause: the ArcadeGremlin.executeStatement() method applies an implicit, undocumented fallback rule - if a query carries any parameter AND gremlin-lang parsing fails, execution is silently handed to the Groovy engine with no security boundary enforced. Because the operator-facing documentation presents gremlin-lang as the secure default without disclosing this fallback behavior, defenders have no observable signal that the insecure engine is being invoked, and the vulnerable code path is reachable through the standard Gremlin HTTP API.

RemediationAI

Upgrade ArcadeDB to version 26.8.1 or later, the vendor-released fix confirmed by the GitHub Security Advisory at https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-wcm5-4wjm-9wj3. If immediate upgrade is not operationally feasible, restrict network access to the Gremlin API endpoint at the firewall or reverse proxy layer to only trusted source IP ranges - trade-off: reduces but does not eliminate exposure if attackers are already on an allowed network segment. Disabling the Gremlin endpoint entirely is a stronger workaround for deployments that do not depend on graph traversal queries, with the trade-off of losing all Gremlin functionality. Authentication hardening (eliminating unused accounts, rotating all database credentials, enforcing strong passwords) reduces the attack surface by raising the cost of initial credential acquisition, but is not a sufficient compensating control on its own since any valid credential at any role level remains exploitable. No vendor-confirmed workaround short of patching or disabling the Gremlin endpoint is available from provided data.