CVE-2022-42009: Apache Ambari

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.

Affected products

• Apache Ambari: from 2.7.0, before 2.7.7 (fixed in 2.7.7)

Published 2023-07-12. Last modified 2026-06-17.