An authenticated remote code execution vulnerability in openEQUELLA versions prior to 2026.1.0 poses a severe risk to system integrity and confidentiality.

This flaw involves unsafe Java deserialization within the HTTP invoker endpoint at /invoker/*. Any authenticated non-guest user can bypass security filters by nesting payloads within a java.security.SignedObject, which triggers a secondary deserialization process that reaches a JNDI sink to execute arbitrary code.

Successful exploitation allows an authenticated attacker to execute arbitrary commands on the underlying server. Given the CVSS score of 8.8, this vulnerability is classified as High severity, representing a significant risk of full system compromise, unauthorized data access, and potential lateral movement within the network.

Immediate Action: Upgrade all instances of openEQUELLA to version 2026.1.0 or later as provided in the official release.

Proactive Monitoring: Audit application access logs for suspicious requests directed at the /invoker/ endpoint, specifically looking for serialized Java objects or unusual JNDI lookups.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block or inspect traffic containing serialized Java objects if immediate patching is not feasible.

Public Exploit Available: Unknown

The vulnerability represents a critical security gap for any organization utilizing openEQUELLA. Administrators should prioritize patching to version 2026.1.0 immediately to eliminate the deserialization risk and prevent potential remote code execution by authenticated users.