Apache Hugegraph vulnerabilities

4 CVEs affecting Apache Hugegraph, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-26866, published 2025-12-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-27348: Apache HugeGraph-Server Improper Access Control Vulnerability, published 2024-04-22. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2024-09-18. EPSS: 99.2% chance of exploitation in the next 30 days. RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to…
CVE-2024-43441, published 2024-12-24. Critical severity, CVSS 9.8. EPSS: 72.8% chance of exploitation in the next 30 days. Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0. Users are recommended to upgrade to…
CVE-2024-27349, published 2024-04-22. Critical severity, CVSS 9.1. EPSS: 1% chance of exploitation in the next 30 days. Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0. Users are recommended to upgrade to version 1.3.0,…
CVE-2025-26866, published 2025-12-12. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster…