# CVE-2026-42785: OpenKM remote code execution in administrative scripting interface

Source: https://junglewise.ai/threats/cve-2026-42785-openkm-remote-code-execution-in-administrative-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-42785 · Severity: high · CVSS 7.2 · Published 2026-05-26

OpenKM, a document management system used by enterprises to store and manage sensitive records, contains a vulnerability in its administrative interface. An attacker with administrative credentials can execute arbitrary commands on the underlying server by submitting malicious scripts through the application's scripting tool. This could lead to a total system takeover, allowing unauthorized access to all stored documents, data theft, or the installation of persistent malware.

Technologies: [OpenKM Community Edition](https://junglewise.ai/threats/technologies/openkm-community-edition), [OpenKM Pro Edition](https://junglewise.ai/threats/technologies/openkm-pro-edition). Vendors: [OpenKM](https://junglewise.ai/threats/vendors/openkm).

## Quick answers

**Is CVE-2026-42785 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42785 being exploited in the wild.

**How severe is CVE-2026-42785?** High severity, with a CVSS score of 7.2, published 26 May 2026.

**Which products and versions are affected?** OpenKM Community Edition 6.3.12 and earlier; OpenKM Pro Edition 7.1.47 and earlier.

**Is there a fix for CVE-2026-42785?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42785 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42785?** Check whether you run OpenKM Community Edition or OpenKM Pro Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A remote code execution (RCE) vulnerability exists in OpenKM Community Edition 6.3.12 and Pro Edition 7.1.47 due to improper control of generation of code (CWE-94) within the administrative scripting interface. The application provides a BeanShell interpreter at the /admin/Scripting endpoint that evaluates user-supplied Java code without sandboxing or command filtering. An authenticated attacker with administrative privileges can submit a script with the 'action=Evaluate' parameter to execute arbitrary operating system commands in the context of the application server. This allows for full system compromise, including file system access and lateral movement. As of the advisory date, no official patch is available, and mitigations include disabling the administrative scripting interface.

## Affected products

- OpenKM OpenKM Community Edition 6.3.12 and earlier
- OpenKM OpenKM Pro Edition 7.1.47 and earlier

## Timeline

- 2026-01-16: disclosed: Initial discovery and report by Terra System Labs
- 2026-04-29: other: Exploit code published on Exploit-DB
- 2026-05-26: advisory: CVE published to NVD dataset

## References

- [https://github.com/terrasystemlabs/Exploits/tree/main/OpenKM-Exploits](https://github.com/terrasystemlabs/Exploits/tree/main/OpenKM-Exploits)
- [https://github.com/terrasystemlabs/Exploits/tree/main/OpenKM-Exploits/nuclei-templates/openkm-remote-code-execution](https://github.com/terrasystemlabs/Exploits/tree/main/OpenKM-Exploits/nuclei-templates/openkm-remote-code-execution)
- [https://hub.docker.com/r/openkm/openkm-ce](https://hub.docker.com/r/openkm/openkm-ce)
- [https://terrasystemlabs.com/post?slug=openkm-zero-day-vulnerabilities-terra-system-labs](https://terrasystemlabs.com/post?slug=openkm-zero-day-vulnerabilities-terra-system-labs)
- [https://www.exploit-db.com/exploits/52520](https://www.exploit-db.com/exploits/52520)
- [https://www.openkm.com/](https://www.openkm.com/)
- [https://www.vulncheck.com/advisories/openkm-remote-code-execution-via-administrative-scripting](https://www.vulncheck.com/advisories/openkm-remote-code-execution-via-administrative-scripting)

## Related threats

- [OpenKM unrestricted SQL execution in DatabaseQuery interface](https://junglewise.ai/threats/cve-2026-42425-openkm-unrestricted-sql-execution-in-databasequery-interface)
- [OpenKM Local File Inclusion in administrative scripting interface](https://junglewise.ai/threats/cve-2026-41917-openkm-local-file-inclusion-in-administrative-scripting-interface)