CVE-2019-10086
HighCVSS 7.3Exploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. However, this was not used by default by PropertyUtilsBean.
Risk Assessment
An attacker may exploit access to the classloader to perform attacks such as remote code execution or privilege escalation.
Recommendation
Upgrade Apache Commons Beanutils to version 1.9.3 or later, which uses this protection by default.
Other vulnerabilities in Apache Commons Beanutils
See all- CVE-2014-0114High
Apache Commons BeanUtils version 1.8.0 and in other products requiring commons-beanutils up to version 1.9.2 does not suppress the class property, allowing remote attackers to manipulate the ClassLoader and execute arbitrary code.
- CVE-2025-48734High
Improper Access Control vulnerability in Apache Commons BeanUtils. If an application passes property paths from an external source directly to PropertyUtilsBean.getProperty() or getNestedProperty(), an attacker can access the 'declaredClass' property of enum objects, gaining access to the ClassLoader and executing arbitrary code.
Original NVD description (English source)
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS