Is CVE-2026-67340 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67340 being exploited in the wild.

How severe is CVE-2026-67340?

High severity, with a CVSS score of 7.2, published 1 August 2026.

Which products and versions are affected?

ArcadeData ArcadeDB before 26.7.2; com.arcadedb:arcadedb-engine (Maven) ECOSYSTEM:introduced=0,fixed=26.7.2.

Is there a fix for CVE-2026-67340?

Yes. com.arcadedb:arcadedb-engine (Maven): upgrade to 26.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67340 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-67340?

Check whether you run ArcadeData ArcadeDB or com.arcadedb:arcadedb-engine (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67340: ArcadeDB trigger script arbitrary Java host class access RCE

CVE-2026-67340 · Severity: high · CVSS 7.2 · Published 2026-08-01

ArcadeDB is a graph database platform that uses JavaScript trigger scripts to respond to database events. Due to overly permissive Java package whitelisting in the script execution environment, an authenticated database user with schema modification rights can create a trigger that executes arbitrary operating system commands when the trigger fires, leading to full server compromise.

Technologies: ArcadeData ArcadeDB, com.arcadedb:arcadedb-engine (Maven). Vendors: ArcadeData, Maven.

Quick answers

Is CVE-2026-67340 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67340 being exploited in the wild.
How severe is CVE-2026-67340?: High severity, with a CVSS score of 7.2, published 1 August 2026.
Which products and versions are affected?: ArcadeData ArcadeDB before 26.7.2; com.arcadedb:arcadedb-engine (Maven) ECOSYSTEM:introduced=0,fixed=26.7.2.
Is there a fix for CVE-2026-67340?: Yes. com.arcadedb:arcadedb-engine (Maven): upgrade to 26.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67340 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-67340?: Check whether you run ArcadeData ArcadeDB or com.arcadedb:arcadedb-engine (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

com.arcadedb:arcadedb-engine (Maven): upgrade to 26.7.2 or later

# set com.arcadedb:arcadedb-engine to 26.7.2 in your pom.xml or build.gradle

Technical details

The ScriptTriggerExecutor class improperly allows trigger JavaScript code to access the full java.lang.* package namespace via the Java.type() method. A user with UPDATE_SCHEMA permission can create a CREATE TRIGGER statement with embedded JavaScript that invokes java.lang.Runtime.getRuntime().exec() or java.lang.ProcessBuilder to execute OS commands. The vulnerability stems from adding java.lang.* to the allowedPackages list combined with HostAccess.ALL permissions, bypassing the reflection denylist since Java.type performs host-class lookup rather than reflection. The trigger fires automatically when database events occur, executing the attacker's payload. Fix available in version 26.7.2 which removes java.lang.* from the allowed package list.

Affected products

ArcadeData ArcadeDB before 26.7.2

Identifiers

CVE-2026-67340
GHSA-x9f9-r4m8-9xc2

Timeline

2026-07-09: disclosed: GitHub Security Advisory GHSA-x9f9-r4m8-9xc2 published
2026-08-01: advisory: CVE-2026-67340 published on NVD
2026-07-09: patched: Fix available in version 26.7.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.