CVE-2026-42537

CriticalCVSS 9.8

Published: 10/08/2026(UTC)Updated: 17/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.20%

66th percentile - higher than 66% of all known CVEs

Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0.

An attacker can exploit JDBC URL injection to execute remote code, potentially leading to system takeover.

Upgrade Apache Ranger to version 2.9.0 or later immediately.

Original NVD description (English source)

Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.