Apache Ivy vulnerabilities

4 CVEs affecting Apache Ivy, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-26032, published 2026-07-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-46751, published 2023-08-21. High severity, CVSS 8.2. EPSS: 2% chance of exploitation in the next 30 days. Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy…
CVE-2022-37865, published 2022-11-07. Critical severity, CVSS 9.1. EPSS: 1.9% chance of exploitation in the next 30 days. With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar"…
CVE-2022-37866, published 2022-11-07. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders for artifacts coordinates like the…
CVE-2026-26032, published 2026-07-15. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored…