Is CVE-2026-111235 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111235 being exploited in the wild.

How severe is CVE-2026-111235?

Critical severity, with a CVSS score of 9.1, published 15 October 2026.

Which products and versions are affected?

OpenNMS Horizon before 36.0.5; OpenNMS Meridian before 2024.3.14, 2025.0.11, 2026.0.1.

How is CVE-2026-111235 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-111235?

Check whether you run OpenNMS Horizon or OpenNMS Meridian at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111235: OpenNMS Meridian and Horizon REST API authorization bypass

CVE-2026-111235 · Severity: critical · CVSS 9.1 · Published 2026-10-15

OpenNMS Meridian and Horizon are network monitoring and management platforms. An authorization bypass in their REST API allows unauthenticated attackers to read monitored inventory and create, modify, or delete resources including injecting fake or suppressing real alarms. This affects organizations relying on these systems for critical infrastructure monitoring.

Technologies: OpenNMS Horizon, OpenNMS Meridian. Vendors: OpenNMS.

Quick answers

Is CVE-2026-111235 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111235 being exploited in the wild.
How severe is CVE-2026-111235?: Critical severity, with a CVSS score of 9.1, published 15 October 2026.
Which products and versions are affected?: OpenNMS Horizon before 36.0.5; OpenNMS Meridian before 2024.3.14, 2025.0.11, 2026.0.1.
Is there a fix for CVE-2026-111235?: Yes: fixed in Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Until then: Ensure Meridian and Horizon installations are isolated within private networks and not directly accessible from the Internet, as documented in installation instructions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111235 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-111235?: Check whether you run OpenNMS Horizon or OpenNMS Meridian at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer

Ensure Meridian and Horizon installations are isolated within private networks and not directly accessible from the Internet, as documented in installation instructions.

Technical details

The REST API's Spring Security filter chains use case-sensitive HTTP method matching in intercept-url rules without a terminal deny rule. Attackers can bypass authorization by sending requests with non-canonical (e.g., lowercase) HTTP methods, which fail to match any rule and are processed unauthenticated. The /rest/alarms endpoint additionally leaks information about alarm existence through response differences.

Affected products

OpenNMS Meridian before 2024.3.14, 2025.0.11, 2026.0.1
OpenNMS Horizon before 36.0.5

Timeline

2026-10-15: disclosed: CVE-2026-111235 published
2026-10-08: patched: Fix merged in pull request #8934

References

https://github.com/OpenNMS/opennms/pull/8934

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.