Apache Ignite vulnerabilities

9 CVEs affecting Apache Ignite, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-48977, published 2026-05-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1273: VMware Tanzu Spring Data Commons Property Binder Vulnerability, published 2018-04-11. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 97% chance of exploitation in the next 30 days. Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An…
CVE-2018-8018, published 2018-07-20. Critical severity, CVSS 9.8. EPSS: 6.7% chance of exploitation in the next 30 days. In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary…
CVE-2018-1295, published 2018-04-02. Critical severity, CVSS 9.8. EPSS: 6.3% chance of exploitation in the next 30 days. In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party…
CVE-2020-1963, published 2020-06-03. Critical severity, CVSS 9.1. EPSS: 5% chance of exploitation in the next 30 days. Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem.
CVE-2021-28163, published 2021-04-01. Low severity, CVSS 2.7. EPSS: 4.2% chance of exploitation in the next 30 days. In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a…
CVE-2024-52577, published 2025-02-14. Critical severity, CVSS 9.0. EPSS: 3.1% chance of exploitation in the next 30 days. In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could be exploited if an attacker manually…
CVE-2017-7686, published 2017-06-28. High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days. Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do…
CVE-2016-6805, published 2017-04-07. Medium severity, CVSS 5.9. EPSS: 2% chance of exploitation in the next 30 days. Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents.
CVE-2025-48977, published 2026-05-28. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Relative Path Traversal vulnerability in Apache Ignite REST API. Authenticated REST API users can read any file on the server with "cmd=log" command and a log path crafted in a certain way. This…