Is CVE-2026-79993 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79993 being exploited in the wild.

How severe is CVE-2026-79993?

High severity, with a CVSS score of 7.5, published 16 September 2026.

Which products and versions are affected?

Apache Zookeeper 3.9.0 through 3.9.5, 3.8.0 through 3.8.6.

Is there a fix for CVE-2026-79993?

A patch was published: Fixed in version 3.9.6 and 3.8.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-79993 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-79993?

Check whether you run Apache Zookeeper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79993: Apache ZooKeeper deleteContainer ACL bypass

CVE-2026-79993 · Severity: high · CVSS 7.5 · Published 2026-09-16

Apache ZooKeeper is a distributed coordination service used to manage configuration and state in distributed systems. An authentication and access control flaw allows any authenticated client to delete arbitrary data nodes (znodes) without proper permission checks, potentially corrupting the distributed system's state or disrupting dependent applications that rely on this data.

Technologies: Apache Zookeeper. Vendors: Apache.

Quick answers

Is CVE-2026-79993 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79993 being exploited in the wild.
How severe is CVE-2026-79993?: High severity, with a CVSS score of 7.5, published 16 September 2026.
Which products and versions are affected?: Apache Zookeeper 3.9.0 through 3.9.5, 3.8.0 through 3.8.6.
Is there a fix for CVE-2026-79993?: A patch was published: Fixed in version 3.9.6 and 3.8.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79993 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-79993?: Check whether you run Apache Zookeeper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass (ACL enforcement bug) in the deleteContainer opcode (0x14/20) processing. The deleteContainer request path completely skips both the session check and the DELETE ACL check that are enforced by the regular delete (OpCode 2) path. An authenticated client opening a plain TCP session on the ZooKeeper client port (default 2181) can delete any empty persistent znode (including regular persistent nodes, container nodes, and TTL nodes) regardless of ACL restrictions. The opcode is internal-only and not exposed in the official client API, but direct protocol manipulation allows exploitation. The fix is available in versions 3.9.6 and 3.8.7.

Affected products

Apache ZooKeeper 3.9.0 through 3.9.5, 3.8.0 through 3.8.6

Timeline

2026-09-16: disclosed: CVE-2026-79993 published
patched: Fixed in version 3.9.6 and 3.8.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.