Apache Commons Beanutils vulnerabilities

3 CVEs affecting Apache Commons Beanutils, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-48734, published 2025-05-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-0114, published 2014-04-30. High severity, CVSS 7.5. EPSS: 99% chance of exploitation in the next 30 days. Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the…
CVE-2019-10086, published 2019-08-20. High severity, CVSS 7.3. EPSS: 28.4% chance of exploitation in the next 30 days. In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all…
CVE-2025-48734, published 2025-05-28. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of…