# CVE-2026-44416: Apache Ranger remote code execution via arbitrary class instantiation in plugin-schema-registry

Source: https://junglewise.ai/threats/cve-2026-44416-apache-ranger-remote-code-execution-via-arbitrary-class  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-44416 · Severity: critical · CVSS 9.8 · Published 2026-08-10

Apache Ranger is an open-source framework for data governance and access control across Hadoop and cloud environments. A vulnerability in its plugin-schema-registry component allows unauthenticated network attackers to execute arbitrary code by instantiating attacker-controlled classes, potentially compromising sensitive data and infrastructure security.

Technologies: [Apache Ranger](https://junglewise.ai/threats/technologies/ranger). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-44416 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44416 being exploited in the wild.

**How severe is CVE-2026-44416?** Critical severity, with a CVSS score of 9.8, published 10 August 2026.

**Which products and versions are affected?** Apache Ranger <=2.8.0.

**Is there a fix for CVE-2026-44416?** A patch was published on 2026-08-10: Fix available in version 2.9.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44416 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-44416?** Check whether you run Apache Ranger at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an arbitrary class instantiation flaw in the plugin-schema-registry component of Apache Ranger versions through 2.8.0. The root cause appears to be insufficient input validation or filtering that allows an attacker to supply malicious class references which are then instantiated and executed by the application, achieving remote code execution. The attack vector is network-based with no authentication required, making it trivially exploitable. An attacker can gain complete control over the Ranger instance and potentially the underlying systems it protects. The fix is available by upgrading to version 2.9.0 or later.

## Affected products

- Apache Ranger <=2.8.0

## Timeline

- 2026-08-10: disclosed
- 2026-08-10: patched: Fix available in version 2.9.0

## References

- [https://lists.apache.org/thread/2gqssqhwkzbpd8jx8q6986cwldr7qkdn](https://lists.apache.org/thread/2gqssqhwkzbpd8jx8q6986cwldr7qkdn)
- [http://www.openwall.com/lists/oss-security/2026/08/09/6](http://www.openwall.com/lists/oss-security/2026/08/09/6)

## Related threats

- [Apache Ranger UnixAuth missing brute-force protection](https://junglewise.ai/threats/cve-2026-65948-apache-ranger-unixauth-missing-brute-force-protection)
- [Apache Ranger JWT token exposure in logs](https://junglewise.ai/threats/cve-2026-65945-apache-ranger-jwt-token-exposure-in-logs)
- [Apache Ranger TLS hostname verification bypass](https://junglewise.ai/threats/cve-2026-65942-apache-ranger-tls-hostname-verification-bypass)
- [Apache Ranger missing authentication in Download APIs](https://junglewise.ai/threats/cve-2026-55814-apache-ranger-missing-authentication-in-download-apis)
- [Apache Ranger remote code execution in GraalScriptEngineCreator](https://junglewise.ai/threats/cve-2026-55799-apache-ranger-remote-code-execution-in-graalscriptenginecreator)