What is the CVSS score of CVE-2026-82384?

CVE-2026-82384 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Apache Roller are affected by CVE-2026-82384?

Apache Roller 6.1.5, the blogging and web publishing platform used for public-facing corporate blogs and community sites, contains a critical unauthenticated remote code execution flaw that can be…

How to fix or mitigate CVE-2026-82384?

Within the next 24 hours, inventory all Apache Roller deployments and confirm exact versions, then immediately block external access to the XML-RPC endpoint at the reverse proxy, web application firewall, or load balancer for any instance running Apache Roller 6.1.5, and restrict the platform to trusted internal networks or VPN-only access until remediation is complete. Within 7 days, upgrade every affected instance to Apache Roller 6.1.6, which the advisory identifies as the vendor-released fixed version, and where the upgrade cannot be scheduled that quickly, keep the XML-RPC path blocked at the perimeter and apply virtual patching rules for deserialization payloads; verify the underlying Java runtime and third-party libraries on the classpath, since successful exploitation depends on a usable deserialization gadget chain being present. Within 30 days, complete the 6.1.6 upgrade across all remaining environments including development and staging, validate that the XML-RPC endpoint is no longer reachable unauthenticated, rotate credentials and secrets stored on or accessible from any Roller host that was internet-exposed, review web server and application logs for anomalous POST traffic to XML-RPC paths, and add Roller version tracking to the standard vulnerability management cadence.

Apache Roller CVE-2026-82384

EUVD-2026-88137 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-09-25

GHSA-9rhg-vvf7-p29p

RCE Apache Java Deserialization

9.8

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated (PR:N), no interaction (UI:N), network-reachable XML-RPC endpoint parsed pre-auth (AV:N/AC:L); deserialization to code execution yields full C/I/A:H within the app process (S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Sep 28, 2026 - 08:22 NVD

9.8 (CRITICAL)

Metadata Corrected

Sep 25, 2026 - 22:40 vuln.today

tag: Java added

Analysis Generated

Sep 25, 2026 - 22:18 vuln.today

CVE Published

Sep 25, 2026 - 21:35 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 5

News 13 New Apache Tomcat Vulnerabilities - 7 Critical, 6 High Severity Sep 26, 2026 News 13 New Jenkins Vulnerabilities - 7 Critical, 6 High Severity Sep 26, 2026 News 13 New Apache Vulnerabilities - 7 Critical, 6 High Severity Sep 26, 2026 News 13 New Jenkins Vulnerabilities - 7 Critical, 6 High Severity Sep 25, 2026 News Critical RCE in Apache Roller 6.1.5 XML-RPC Endpoint - CVE-2026-82384 Sep 25, 2026

AnalysisAI

Unauthenticated remote code execution in Apache Roller 6.1.5, where the XML-RPC endpoint deserializes attacker-controlled bytes during request parsing before any authentication check occurs. The servlet is mapped unconditionally, so the vulnerable parsing path is still reachable even when the global XML-RPC feature is turned off, and no non-default configuration is required. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No special conditions - remote unauthenticated exploitation against default configurations of Apache Roller 6.1.5. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine top-priority vulnerability, not a high-CVSS-but-low-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to Apache Roller 6.1.6 or later, which is the vendor-released fix that disables the vendor extension types and rejects requests while the XML-RPC feature is disabled; this is the only complete remediation and should be treated as urgent given the unauthenticated pre-auth RCE path. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within the next 24 hours, inventory all Apache Roller deployments and confirm exact versions, then immediately block external access to the XML-RPC endpoint at the reverse proxy, web application firewall, or load balancer for any instance running Apache Roller 6.1.5, and restrict the platform to trusted internal networks or VPN-only access until remediation is complete. …

Threat intelligence, references, and detailed analysis are available after sign-in.