CVE-2026-62764
Full vulnerability record from the local CVENow database.
Description
Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo. An authenticated, but low-privileged user without system permissions may issue a remote command to gracefully shutdown system components (compaction-coordinator, compactor, gc, manager, monitor, tserver, or sserver), leading to a denial of service. This issue affects Apache Accumulo 2.1.4 and 2.1.5. Users are recommended to upgrade to version 2.1.6, which fixes the issue.
Severity
MEDIUM
CVSS score
5.7
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-17 09:16:41.853000
Last modified
2026-10-24 20:10:00.137000
View original CVE JSON
{
"id": "CVE-2026-62764",
"sourceIdentifier": "[email protected]",
"published": "2026-07-17T09:16:41.853",
"lastModified": "2026-10-24T20:10:00.137",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo.\nAn authenticated, but low-privileged user without system permissions may\nissue a remote command to gracefully shutdown system components\n(compaction-coordinator, compactor, gc, manager, monitor, tserver, or sserver),\nleading to a denial of service.\n\nThis issue affects Apache Accumulo 2.1.4 and 2.1.5.\n\nUsers are recommended to upgrade to version 2.1.6, which fixes the issue."
},
{
"lang": "es",
"value": "Vulnerabilidad de Manejo Inadecuado de Privilegios Insuficientes en Apache Accumulo.\nUn usuario autenticado, pero con pocos privilegios y sin permisos de sistema, puede emitir un comando remoto para apagar de forma controlada los componentes del sistema (coordinador de compactación, compactador, gc, gestor, monitor, tserver o sserver), lo que lleva a una denegación de servicio.\n\nEste problema afecta a Apache Accumulo 2.1.4 y 2.1.5.\n\nSe recomienda a los usuarios actualizar a la versión 2.1.6, que soluciona el problema."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Accumulo",
"defaultStatus": "unaffected",
"collectionURL": "https://repo.maven.apache.org/maven2",
"packageName": "org.apache.accumulo:accumulo-server-base",
"versions": [
{
"version": "2.1.4",
"lessThanOrEqual": "2.1.5",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:L/U:Green",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NEGLIGIBLE",
"Automatable": "YES",
"Recovery": "USER",
"valueDensity": "DIFFUSE",
"vulnerabilityResponseEffort": "LOW",
"providerUrgency": "GREEN"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-17T10:07:29.103234Z",
"id": "CVE-2026-62764",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-274"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:accumulo:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.1.4",
"versionEndExcluding": "2.1.6",
"matchCriteriaId": "7B39ADF5-3925-41C9-8F21-57F1A8741739"
}
]
}
]
}
],
"references": [
{
"url": "https://accumulo.apache.org/downloads/",
"source": "[email protected]",
"tags": [
"Product"
]
},
{
"url": "https://accumulo.apache.org/release/accumulo-2.1.6/",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://github.com/apache/accumulo/issues/6478",
"source": "[email protected]",
"tags": [
"Issue Tracking",
"Patch"
]
},
{
"url": "https://lists.apache.org/thread/qclg736k93oqn4qrpw9wxjbb3jhn6gm1",
"source": "[email protected]",
"tags": [
"Mailing List",
"Vendor Advisory"
]
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/17/6",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
]
}
]
}