Camunda 7 EUVD-2026-104392

Exploitation requires an authenticated user who can reach the ad-hoc task-query API (TaskQueryDto via the Camunda REST/Tasklist interface) and specifically the orQueries field, and requires that the installation permits submitting query expressions - the normal enableExpressionsInAdhocQueries safeguard is the control being bypassed, so the flaw works even when that restriction is intended to be enforced because AdhocQueryValidator.validate() does not recurse into orQueries sub-query expression maps. Limiting factors: valid credentials/session are needed (contradicting the PR:N in the supplied vector), the target must be a vulnerable version (7.24.0-7.24.13 or 7.23.0-7.23.16), and impact runs with the privileges of the engine service user. No special user interaction is required beyond submitting the crafted query.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk paper finding. The CWE-917 JUEL expression injection yields arbitrary java.lang.Runtime.exec, i.e. full OS command execution as the engine service user, so technical impact is total (VC:H/VI:H/VA:H). The strongest risk signal is that public exploit code already exists (codeant.ai research write-up and VulnCheck advisory), which materially raises the odds of opportunistic weaponization even though CISA KEV does not list it and there is no confirmed active exploitation yet. There is a notable conflict in the authentication signal: the supplied CVSS 4.0 vector states PR:N (unauthenticated), but the description explicitly says 'allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction' - these disagree, and the description's requirement for an authenticated session to reach the ad-hoc query API is more credible, so real exploitation almost certainly needs valid (even low-privilege) credentials; verify with the vendor. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified. Net: treat as urgent patch priority wherever Camunda 7 exposes the Tasklist/REST query API to any authenticated user, but factor in that authentication is a real gating control contradicting the PR:N metric.

An authenticated user with access to the Camunda REST/Tasklist task-query API submits a TaskQueryDto containing an orQueries sub-query whose dueAfterExpression holds a malicious JUEL expression; because AdhocQueryValidator.validate() never inspects sub-query expression maps, the enableExpressionsInAdhocQueries guard is bypassed and the expression is evaluated, invoking java.lang.Runtime.exec to run attacker-chosen OS commands as the engine service user. Public exploit code for this exact orQueries path is already available, lowering the skill required to reproduce it.