CVE-2019-10086: Apache Commons Beanutils

High severity, CVSS 7.3. EPSS: 28.4% chance of exploitation in the next 30 days.

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

Affected products

Apache Commons Beanutils: from 1.0, up to and including 1.9.3
Apache Nifi: version 1.14.0 only; version 1.15.0 only
Debian Debian Linux: version 8.0 only
Fedoraproject Fedora: version 30 only; version 31 only
Opensuse Leap: version 15.0 only; version 15.1 only
Oracle Agile Product Lifecycle Management: version 9.3.3 only; version 9.3.5 only; version 9.3.6 only
Oracle Agile Product Lifecycle Management Integration Pack: version 3.5 only; version 3.6 only
Oracle Application Testing Suite: version 13.3.0.1 only
Oracle Banking Platform: version 2.4.0 only; version 2.7.1 only; version 2.9.0 only
Oracle Blockchain Platform: before 21.1.2 (fixed in 21.1.2)
Oracle Communications Billing And Revenue Management: version 7.5 only; version 12.0.0.3.0 only
Oracle Communications Billing And Revenue Management Elastic Charging Engine: version 11.3.0.9 only; version 12.0.0.3 only
Oracle Communications Cloud Native Core Console: version 1.4.0 only
Oracle Communications Cloud Native Core Policy: version 1.9.0 only
Oracle Communications Cloud Native Core Unified Data Repository: version 1.6.0 only
Oracle Communications Convergence: version 3.0.2.2.0 only
Oracle Communications Design Studio: version 7.3.4 only; version 7.3.5 only; version 7.4.0 only
Oracle Communications Evolved Communications Application Server: version 7.1 only
Oracle Communications Metasolv Solution: version 6.3.0 only; version 6.3.1 only
Oracle Communications Network Integrity: version 7.3.6 only
Oracle Communications Performance Intelligence Center: version 10.4.0.3 only
Oracle Communications Pricing Design Center: version 12.0.0.3.0 only
Oracle Communications Unified Inventory Management: version 7.3.4 only; version 7.3.5 only; version 7.4.0 only; version 7.4.1 only
Oracle Customer Management And Segmentation Foundation: version 18.0 only
Oracle Enterprise Manager For Virtualization: version 13.4.0.0 only
and 35 more

Published 2019-08-20. Last modified 2026-10-08.