Apache Ranger EUVD-2026-55249

Exploitation requires the ability to supply input that reaches Apache Ranger's GraalScriptEngineCreator - in practice, the evaluation path for script-based policy conditions/expressions in the Ranger Admin service - on any version ≤ 2.8.0. The vendor CVSS marks PR:N/UI:N (no authentication or user interaction), implying reachability from an unauthenticated network position against a default deployment; however, the description does not state where the script input originates, and Ranger script/condition evaluation is normally an admin/policy-author function, so the practical prerequisite may be authenticated access to the Ranger Admin API - this should be confirmed against the Apache advisory. Limiting factors are network reachability of the Ranger Admin endpoint (typically internal to a data-platform management network) and whatever privilege is actually needed to define the evaluated script.

The signals are mixed rather than uniformly alarming. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) and 9.8 score describe a network-reachable, low-complexity, unauthenticated path to full confidentiality/integrity/availability loss - a maximal-severity profile. However, EPSS is only 0.34% (26th percentile), the CVE is not listed in CISA KEV, and no public POC is referenced, so there is no evidence of active or imminent exploitation. There is also a plausible tension between the PR:N rating and the nature of the component: script-engine evaluation in Ranger is typically driven by policy or condition definitions authored through the admin interface, which would normally require authenticated, privileged access - verify the true privilege requirement with the Apache advisory, because if authentication is in fact required the real-world exploitability is narrower than the vector implies. Net: treat as a high-priority patch for anyone running Ranger given the impact ceiling, but current data points to targeted rather than mass exploitation risk.

An attacker who can reach the Ranger Admin service submits a crafted script-based policy condition or expression that is passed to the GraalScriptEngineCreator, which evaluates it without sufficient sandboxing and executes attacker-controlled code on the Ranger server. With AV:N/AC:L the request requires no special timing or user interaction, and successful execution yields code execution in the Ranger process context, potentially pivoting to the broader Hadoop authorization plane. No public exploit code has been identified at time of analysis.