CVE-2021-3396: Opennms Horizon

High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days.

OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions.

Affected products

• Opennms Horizon: from 16.0.0, up to and including 27.0.3
• Opennms Meridian: from 2016.1.0, up to and including 2016.1.24; from 2017.1.0, up to and including 2017.1.26; from 2018.1.0, before 2018.1.25 (fixed in 2018.1.25); from 2019.1.0, before 2019.1.16 (fixed in 2019.1.16); from 2020.1.0, before 2020.1.5 (fixed in 2020.1.5)
• Opennms Newts: before 1.5.3 (fixed in 1.5.3)

Published 2021-02-17. Last modified 2026-06-17.