Which versions of Logback Core are affected by EUVD-2026-38691?

A high-severity arbitrary code execution vulnerability in QOS.CH logback-core affects Java applications leveraging this widely-used logging library, enabling attackers with local system access and…

How to fix or mitigate EUVD-2026-38691?

Within 24 hours: Identify all systems using logback-core versions up to 1.5.34 and verify if Janino library is enabled on the classpath. Within 7 days: Implement immediate controls including (1) restricting write access to logback configuration files, (2) disabling environment variable-based configuration loading, and (3) removing Janino from classpath if operationally feasible. Within 30 days: Establish monitoring for vendor patch announcements and prepare upgrade plan to apply patch once released; evaluate alternative logging solutions if available.

Logback Core EUVD-2026-38691

Q: What is the CVSS score of EUVD-2026-38691?

EUVD-2026-38691 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green. EPSS exploitation probability: 0.1%.

| CVE-2026-13006 HIGH

Improper Input Validation (CWE-20)

2026-06-24 NCSC.ch

GHSA-567r-vvh5-jjr8

RCE Java Logback Core Qos Ch Sarl

7.0

CVSS 4.0 · Vendor: NCSC.ch

Severity by source

Vendor (NCSC.ch) PRIMARY

7.0 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green

vuln.today AI

5.7 MEDIUM

Local config/env access (AV:L, PR:H), Janino-on-classpath precondition raises complexity (AC:H), full code execution gives C:H/I:H, no availability impact described.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

6.0 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Red Hat

6.0 MEDIUM

qualitative

Primary rating from Vendor (NCSC.ch).

CVSS VectorVendor: NCSC.ch

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 06:53 vuln.today

DescriptionCVE.org

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.34 in Java applications, allows an attacker to execute arbitrary code circumventing existing protections against CVE-2025-11226 by compromising an existing logback configuration file or by injecting an environment variable before program execution.

A successful attack requires the presence of Janino library to be present on the user's class path. In addition, the attacker must have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.

Articles & Coverage 2

News 3 New Java Vulnerabilities - 2 Critical, 1 High Severity Jun 25, 2026 News 3 New Java Vulnerabilities - 3 High Severity Jun 24, 2026

AnalysisAI

Arbitrary code execution in QOS.CH logback-core versions up to and including 1.5.34 allows a local attacker with existing privilege to run code in the context of any Java application that loads Logback when the Janino library is on the classpath. The flaw circumvents prior hardening for CVE-2025-11226 via conditional configuration file processing, and is triggered either by writing to an existing logback configuration file or by injecting an environment variable that points the process at a malicious configuration. No public exploit identified at time of analysis, though the bypass nature of the issue makes weaponization of existing CVE-2025-11226 exploit code plausible.

Technical ContextAI

Logback-core is the foundational module of the Logback logging framework (cpe:2.3:a:qos.ch_sarl:logback-core), a near-default replacement for log4j 1.x in Spring Boot and many other Java stacks. Logback supports conditional processing inside logback.xml using <if>, <then>, and <else> elements whose expressions are compiled at runtime by the Janino in-memory Java compiler when janino.jar is present on the classpath; this is the same execution channel that produced CVE-2025-11226. The root cause is CWE-20 Improper Input Validation: the 1.5.34 fix for CVE-2025-11226 did not fully constrain what Janino-compiled expressions or referenced configuration paths could do, so an attacker who can either modify the loaded configuration file or point Logback at a different one (via the documented configuration-file environment/system property) can still drive Janino into compiling and executing attacker-controlled Java code at application startup or reload.

RemediationAI

Upgrade logback-core to version 1.5.35 or later, the vendor-released patch announced at https://logback.qos.ch/news.html#1.5.35, and rebuild or redeploy any application that bundles a vulnerable copy (including transitive Spring Boot and other framework dependencies). Where an immediate upgrade is not possible, remove the Janino library (janino*.jar) from the application classpath, which disables <if> conditional configuration processing and neutralises this attack path at the cost of losing any legitimate runtime conditionals in logback.xml. Additionally, restrict filesystem permissions on logback.xml/logback-test.xml and parent directories to the application owner only, prevent untrusted processes from setting the logback.configurationFile system property or equivalent environment variables, and monitor for unexpected modifications of logging configuration in production builds.