Apache Geode vulnerabilities

23 CVEs affecting Apache Geode, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-47410, published 2025-10-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-1938: Apache Tomcat Improper Privilege Management Vulnerability, published 2020-02-24. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 99.3% chance of exploitation in the next 30 days. When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar…
CVE-2019-15752: Docker Desktop Community Edition Privilege Escalation Vulnerability, published 2019-08-28. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 48.6% chance of exploitation in the next 30 days. Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a…
CVE-2014-0048, published 2020-01-02. Critical severity, CVSS 9.8. EPSS: 7.3% chance of exploitation in the next 30 days. An issue was found in Docker before 1.6.0. Some programs and scripts in Docker are downloaded via HTTP and then executed or used in unsafe ways.
CVE-2019-14892, published 2020-03-02. Critical severity, CVSS 9.8. EPSS: 5.6% chance of exploitation in the next 30 days. A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2…
CVE-2017-15692, published 2018-02-27. Critical severity, CVSS 9.8. EPSS: 4.8% chance of exploitation in the next 30 days. In Apache Geode before v1.4.0, the TcpServer within the Geode locator opens a network port that deserializes data. If an unprivileged user gains access to the Geode locator, they may be able to cause…
CVE-2017-9795, published 2018-01-10. High severity, CVSS 7.5. EPSS: 4.2% chance of exploitation in the next 30 days. When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries that allow read and write access to…
CVE-2017-5649, published 2017-04-04. High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days. Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the…
CVE-2017-15695, published 2018-06-13. High severity, CVSS 8.8. EPSS: 2.6% chance of exploitation in the next 30 days. When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invoking an internal Geode function. This…
CVE-2022-37021, published 2022-08-31. Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days. Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect…
CVE-2021-34797, published 2022-01-04. High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days. Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for…

Latest

CVE-2025-47410, published 2025-10-18. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session…
CVE-2024-44088, published 2025-10-14. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. Malicious script injection ('Cross-site Scripting') vulnerability in Apache Geode web-api (REST). This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted…
CVE-2022-34870, published 2022-10-25. Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days. Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries.
CVE-2022-37023, published 2022-08-31. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks…
CVE-2022-37022, published 2022-08-31. High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days. Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11. Any user wishing to protect against deserialization…
CVE-2019-10091, published 2020-03-16. High severity, CVSS 7.4. EPSS: 1.4% chance of exploitation in the next 30 days. When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries in the certificate SAN during the SSL handshake. This…