# CVE-2026-67615: openEQUELLA remote code execution via Java deserialization

Source: https://junglewise.ai/threats/cve-2026-67615-openequella-before-2026-1-0-contains-an-authenticated-remote-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-67615 · Severity: high · CVSS 8.8 · Published 2026-09-22

openEQUELLA is a digital repository system used by universities to store and manage media content. Any authenticated user can execute arbitrary code on the server by sending a crafted serialized Java object to the HTTP invoker endpoint. This allows an attacker with a valid account to take complete control of the system and access all stored data.

Technologies: [openEQUELLA](https://junglewise.ai/threats/technologies/openequella). Vendors: [openEQUELLA](https://junglewise.ai/threats/vendors/openequella).

## Quick answers

**Is CVE-2026-67615 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67615 being exploited in the wild.

**How severe is CVE-2026-67615?** High severity, with a CVSS score of 8.8, published 22 September 2026.

**Which products and versions are affected?** openEQUELLA before 2026.1.0.

**Is there a fix for CVE-2026-67615?** A patch was published on 2026-09-04: Fixed in version 2026.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67615 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-67615?** Check whether you run openEQUELLA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the /invoker/* endpoint which deserializes untrusted Java objects without proper validation. Attackers bypass the PluginAwareObjectInputStream class-name denylist by wrapping a malicious payload in a java.security.SignedObject, causing the inner payload to be deserialized by a separate ObjectInputStream that does not enforce the denylist. The attacker can then chain gadgets to reach a JNDI sink, achieving remote code execution through LDAP callback injection.

## Affected products

- openEQUELLA openEQUELLA before 2026.1.0

## Timeline

- 2026-09-22: disclosed: CVE-2026-67615 published
- 2026-09-04: patched: Fixed in version 2026.1.0

## References

- [https://blog.evan.lat/posts/openeq](https://blog.evan.lat/posts/openeq)
- [https://github.com/openequella/openEQUELLA/releases/tag/2026.1.0](https://github.com/openequella/openEQUELLA/releases/tag/2026.1.0)

## Related threats

- [openEQUELLA stored cross-site scripting in login notice](https://junglewise.ai/threats/cve-2026-66092-in-openequella-before-2026-2-the-pre-login-notice-is-stored-as)
- [openEQUELLA authentication bypass in user info endpoint](https://junglewise.ai/threats/cve-2026-66091-in-openequella-before-2026-1-the-get-api-userquery-userinfobackup)
- [openEQUELLA XXE in item metadata XML parser](https://junglewise.ai/threats/cve-2026-66090-in-openequella-before-2026-1-the-xml-parser-used-for-item)
- [openEQUELLA XML external entity injection in SOAP API](https://junglewise.ai/threats/cve-2026-66089-in-openequella-before-2026-1-the-soap-api-parses-xml-supplied-in)
- [openEQUELLA OS command injection in scripting engine](https://junglewise.ai/threats/cve-2026-66088-in-openequella-before-2026-1-the-system-execute-function)