What is the CVSS score of EUVD-2026-78626?

EUVD-2026-78626 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Which versions of Java are affected by EUVD-2026-78626?

A high-severity remote code execution flaw in RuoYi-Vue-Plus 6.0.0 allows any user with a valid, low-privileged account to execute arbitrary Java code on the application server through a standard…

How to fix or mitigate EUVD-2026-78626?

Within 24 hours, confirm whether RuoYi-Vue-Plus 6.0.0 is deployed in production and inventory the systems, data, and downstream integrations reachable from those servers; restrict network access to the /workflow/task/completeTask endpoint to trusted management networks where feasible, and audit workflow-related accounts for unnecessary privileges. Within 7 days, enforce least privilege and multi-factor authentication for all RuoYi accounts, limit and monitor the low-privileged roles that can invoke workflow task-completion endpoints, enable detailed logging and alerting on FlwTaskController and FlwTaskServiceImpl activity, and place affected instances behind a web application firewall with rules targeting anomalous workflow requests. Within 30 days, apply the vendor-released patch for RuoYi-Vue-Plus as soon as it becomes available, or migrate to a supported release; if vendor timelines slip, evaluate network segmentation, containerized isolation, or an alternative workflow component to reduce exposure, and conduct a retrospective review of authentication and authorization controls across the platform.

Java EUVD-2026-78626

| CVE-2026-88616 HIGH

Incorrect Authorization (CWE-863)

2026-09-15 mitre

GHSA-cj4v-qxg2-mjcc

Authentication Bypass RCE Java N A

8.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 20:25 vuln.today

CVE Published

Sep 15, 2026 - 00:00 cve.org

HIGH 8.8

CVE Published

Sep 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST /workflow/task/completeTask components

AnalysisAI

Remote code execution in RuoYi-Vue-Plus 6.0.0 lets an authenticated low-privileged user run arbitrary Java code on the server through the workflow task-completion endpoint POST /workflow/task/completeTask, which flows through FlwTaskController.java into FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process and the Warm-Flow TaskService.skip path. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting network reachability and complete confidentiality, integrity and availability impact, but it requires a valid authenticated session rather than being pre-auth. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, confirm whether RuoYi-Vue-Plus 6.0.0 is deployed in production and inventory the systems, data, and downstream integrations reachable from those servers; restrict network access to the /workflow/task/completeTask endpoint to trusted management networks where feasible, and audit workflow-related accounts for unnecessary privileges. …

Threat intelligence, references, and detailed analysis are available after sign-in.