Is CVE-2026-11457 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11457 being exploited in the wild.

How severe is CVE-2026-11457?

High severity, with a CVSS score of 7.3, published 7 June 2026.

Which products and versions are affected?

Erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69.

Is there a fix for CVE-2026-11457?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11457 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-11457?

Check whether you run Erzhongxmu JeeWMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11457: erzhongxmu JeeWMS remote code execution in JimuReport testConnection

CVE-2026-11457 · Severity: high · CVSS 7.3 · Published 2026-06-07

JeeWMS, a warehouse management system, contains a security flaw in its database connection testing feature. An unauthenticated attacker can exploit this to remotely execute commands on the server. This could lead to a complete takeover of the system, unauthorized access to inventory data, and disruption of warehouse operations.

Technologies: Erzhongxmu JeeWMS. Vendors: Erzhongxmu.

Quick answers

Is CVE-2026-11457 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11457 being exploited in the wild.
How severe is CVE-2026-11457?: High severity, with a CVSS score of 7.3, published 7 June 2026.
Which products and versions are affected?: Erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69.
Is there a fix for CVE-2026-11457?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11457 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-11457?: Check whether you run Erzhongxmu JeeWMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the JimuReport test-connection endpoint (/base-boot/jmreport/testConnection) of JeeWMS. The endpoint is explicitly configured for anonymous access in ShiroConfig and accepts attacker-controlled JDBC parameters (dbType, dbDriver, dbUrl, etc.). By supplying a malicious PostgreSQL JDBC URL with 'socketFactory' and 'socketFactoryArg' parameters, an attacker can trigger arbitrary class instantiation. In specific environments, this allows loading a remote Spring XML configuration file to achieve Remote Code Execution (RCE). The vulnerability is present in versions up to commit 141740afb2ba14d441c82a833d0a418d07ca2d69.

Affected products

erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69

Timeline

2026-05-13: disclosed: Initial public disclosure on GitHub issues
2026-06-07: advisory: NVD/VulDB publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.