Is CVE-2026-39842 actively exploited?

No active exploitation of CVE-2026-39842 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-39842 be exploited remotely?

Yes. CVE-2026-39842 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-39842?

CVE-2026-39842 has a CVSS score of 9.9 (CRITICAL).

HOME VULNERABILITIESCVE-2026-39842

CRITICAL

CVE-2026-39842

CWE-94Published: April 15, 2026· Updated: Apr 17, 2026

9.9

CVSS v3.1

EPSS:0.15%probability of exploitation in 30 daysPercentile:35.1th

Official Description

OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine that allow arbitrary code execution on the server. The JavaScript rules engine executes user-supplied scripts via Nashorn's ScriptEngine.eval() without sandboxing, class filtering, or access restrictions, and the authorization check in RulesResourceImpl only restricts Groovy rules to superusers while leaving JavaScript rules unrestricted for any user with the write:rules role. Additionally, the Groovy rules engine has a GroovyDenyAllFilter security filter that is defined but never registered, as the registration code is commented out, rendering the SandboxTransformer ineffective for superuser-created Groovy rules. A non-superuser attacker with the write:rules role can create JavaScript rulesets that execute with full JVM access, enabling remote code execution as root, arbitrary file read, environment variable theft including database credentials, and complete multi-tenant isolation bypass to access data across all realms. This issue has been fixed in version 1.22.0.

NVD Source

Technical Analysis

CVE-2026-39842 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.9.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.