OpenNMS Horizon EUVD-2026-75707

The attacker must be able to reach the OpenNMS Horizon web interface over the network via HTTP or HTTPS. No authentication, credentials, or user interaction are required - the PATCH HTTP method on the affected /api/v2 endpoints (/api/v2/eventconf/, /api/v2/datacollectionconf/, /api/v2/snmp-config/, /api/v2/trapd/) was entirely absent from the Spring Security authorization policy prior to the fix, meaning the application's security framework performed no authorization check at all for these requests. Exploitation is limited to Horizon versions prior to 36.0.4. The primary mitigating deployment constraint is the vendor's explicit guidance that Horizon and Meridian should reside on private networks inaccessible from the internet; exploitation therefore typically requires prior network access through lateral movement, VPN access, or misconfigured network exposure. Only PATCH requests are the unprotected vector - GET, POST, PUT, and DELETE methods on these endpoints had existing authorization rules and are not affected.

The CVSS 8.2 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) accurately represents the risk profile: zero-complexity unauthenticated network exploitation with persistent integrity impact and partial availability degradation. The absence of a confidentiality component is deliberate - no data is read or exfiltrated. The vendor's own deployment guidance explicitly states that Horizon and Meridian are intended for private networks and must not be directly internet-accessible, which meaningfully limits the realistic attack surface; however, even a mid-sized municipal IT team in rybnik operating OpenNMS on an insufficiently segmented internal network faces genuine exposure to lateral-movement scenarios where a compromised LAN host can reach the monitoring plane and disable detection before a larger intrusion. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. EPSS data was not provided in the source material. The primary real-world threat model is use as a precursor: silently blinding monitoring infrastructure to suppress alarms during a follow-on attack, which is a high-value outcome disproportionate to the low technical difficulty.

An attacker who has gained a foothold on the internal network sends a series of unauthenticated HTTP PATCH requests to /api/v2/eventconf/ endpoints to disable critical event definitions covering link-down or authentication-failure events, then issues PATCH requests to /api/v2/datacollectionconf/ to halt SNMP metric collection from key network devices. With monitoring silently blinded and no alerts firing, the attacker proceeds with a broader intrusion campaign confident that no performance anomalies or security events will be recorded. No public exploit code has been identified, but the attack requires only standard HTTP tooling such as curl.