Is CVE-2026-66088 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66088 being exploited in the wild.

How severe is CVE-2026-66088?

Informational severity, published 29 October 2026.

Is there a fix for CVE-2026-66088?

Yes: fixed in 2026.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66088 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-66088?

Check whether you run openEQUELLA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66088: openEQUELLA OS command injection in scripting engine

CVE-2026-66088 · Severity: info · Published 2026-10-29

openEQUELLA is a digital repository and content management system used by educational and research institutions. The system.execute() function in its scripting engine allows users who can create or edit scripts to run arbitrary operating system commands with the privileges of the service account, potentially leading to full system compromise, data theft, or service disruption.

Technologies: openEQUELLA. Vendors: openEQUELLA.

Quick answers

Is CVE-2026-66088 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66088 being exploited in the wild.
How severe is CVE-2026-66088?: Informational severity, published 29 October 2026.
Which products and versions are affected?: openEQUELLA before 2026.1.
Is there a fix for CVE-2026-66088?: Yes: fixed in 2026.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66088 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-66088?: Check whether you run openEQUELLA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2026.1

Technical details

The system.execute() function in openEQUELLA's scripting engine runs supplied OS commands without validation or allowlisting. An authenticated attacker with script creation or editing privileges can invoke this function to execute arbitrary commands with the service account's privileges, bypassing authorization controls. A fix is available in version 2026.1 and later.

Affected products

openEQUELLA openEQUELLA before 2026.1

Timeline

2026-10-29: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.