Apache Jackrabbit vulnerabilities

8 CVEs affecting Apache Jackrabbit, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-92415, published 2026-10-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-1833, published 2015-05-29. Medium severity, CVSS 6.4. EPSS: 55.9% chance of exploitation in the next 30 days. XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote…
CVE-2009-0026, published 2009-01-21. Medium severity, CVSS 4.3. EPSS: 26.8% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.jsp or (2)…
CVE-2023-37895, published 2023-07-25. Critical severity, CVSS 9.8. EPSS: 3.2% chance of exploitation in the next 30 days. Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch) and 2.21.17…
CVE-2016-6801, published 2016-09-21. High severity, CVSS 8.8. EPSS: 2.3% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before…
CVE-2025-58782, published 2025-09-08. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit…
CVE-2026-92414, published 2026-10-07. Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days. : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any…
CVE-2026-92415, published 2026-10-07. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the…
CVE-2025-53689, published 2025-07-14. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade…