CVE-2026-42785: Openkm Community Edition

High severity, CVSS 7.2. EPSS: 1.2% chance of exploitation in the next 30 days.

OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system commands in the context of the OpenKM application server.

Affected products

• Openkm Openkm Community Edition: up to and including 6.3.12
• Openkm Openkm Professional Edition: up to and including 7.1.47

Published 2026-05-26. Last modified 2026-10-06.