Hazelcast EUVD-2026-95313

Exploitation requires an authenticated client connection to the Hazelcast cluster holding at least limited (low-privilege) credentials (CVSS PR:L) - it is not reachable by fully unauthenticated attackers. The specific trigger is use of the IMap Predicates API aggregation/projection operations, which the patch shows were missing AGGREGATE and PROJECTION permission enforcement in MapPermission; any deployment permitting client connections with partial map privileges is affected in default configuration. The primary limiting factor is the need for valid cluster client credentials; environments that restrict client access, enforce network segmentation around cluster members, or have already upgraded to 5.4.5/5.5.10/5.6.1/5.7.0 are not exposed. No vendor workaround exists other than upgrading.

The CVSS 4.0 base score of 8.7 (High) reflects a network-reachable (AV:N), low-complexity (AC:L) vulnerability with no attack requirements (AT:N) and no user interaction (UI:N), requiring only low privileges (PR:L) to achieve full compromise of confidentiality, integrity, and availability on the targeted system (VC:H/VI:H/VA:H), with no subsequent-system impact (SC:N/SI:N/SA:N). The CWE-862 (Missing Authorization) classification is corroborated by the vendor commit, which adds AGGREGATE and PROJECTION permission checks to MapPermission - confirming the vulnerability is an authorization gap exploitable by an already-authenticated client, NOT an unauthenticated bypass. This is a genuine priority rather than inflated-CVSS noise: the technical impact is arbitrary code execution on a cluster member and the vendor explicitly states there is no workaround other than patching. However, two signals temper widespread-risk concern: PR:L means the attacker must already possess valid (if limited) cluster client credentials, and no EPSS score, CISA KEV listing, or public POC was provided in the input - so there is no evidence of active exploitation or weaponization. Net: high-severity, patch-worthy, but current real-world exploitation signal is absent and access is gated behind authentication.

A malicious or compromised client that holds only limited (low-privilege) credentials to a Hazelcast cluster invokes the IMap Predicates API with aggregation/projection operations that were not subject to proper authorization checks. Because the required AGGREGATE/PROJECTION permissions were never enforced, the client can supply logic that executes arbitrary code in the context of a cluster member, escalating from a restricted client to full control of the data platform. No public exploit identified at time of analysis, so exploitation would require an attacker to independently develop the technique.