CVE-2026-6264

{
  "id": "CVE-2026-6264",
  "sourceIdentifier": "4ac701fe-44e9-4bcd-9585-dd6449257611",
  "published": "2026-04-14T03:16:09.050",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A critical vulnerability in the Talend JobServer and Talend Runtime allows unauthenticated remote code execution via the JMX monitoring port. The attack vector is the JMX monitoring port of the Talend JobServer. The vulnerability can be mitigated for the Talend JobServer by requiring TLS client authentication for the monitoring port; however, the patch must be applied for full mitigation. For Talend ESB Runtime, the vulnerability can be mitigated by disabling the JobServer JMX monitoring port, which is disabled by default from the R2024-07-RT patch."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad crítica en Talend JobServer y Talend Runtime permite la ejecución remota de código no autenticada a través del puerto de monitoreo JMX. El vector de ataque es el puerto de monitoreo JMX de Talend JobServer. La vulnerabilidad puede ser mitigada para Talend JobServer al requerir autenticación de cliente TLS para el puerto de monitoreo; sin embargo, el parche debe ser aplicado para una mitigación completa. Para Talend ESB Runtime, la vulnerabilidad puede ser mitigada deshabilitando el puerto de monitoreo JMX de JobServer, el cual está deshabilitado por defecto a partir del parche R2024-07-RT."
    }
  ],
  "affected": [
    {
      "source": "4ac701fe-44e9-4bcd-9585-dd6449257611",
      "affectedData": [
        {
          "vendor": "Talend",
          "product": "Talend JobServer",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "8.0",
              "lessThan": "TPS-6017",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "7.3",
              "lessThan": "TPS-6018",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Talend",
          "product": "Talend Runtime",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "8.0",
              "lessThan": "8.0.1.R2026-01-RT",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "7.3",
              "lessThan": "7.3.1-R2026-01",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "4ac701fe-44e9-4bcd-9585-dd6449257611",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-14T13:07:04.623162Z",
          "id": "CVE-2026-6264",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "references": [
    {
      "url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fix-for-the-Qlik-Talend-JobServer-and-Talend/tac-p/2541974",
      "source": "4ac701fe-44e9-4bcd-9585-dd6449257611"
    }
  ]
}