CVE-2022-26111 json
The BeanShell components of IRISNext through 9.8.28 allow execution of arbitrary commands on the target server by creating a custom search…
published 2022-04-25 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-30679
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.2%
- EPSS 4.2% chance of exploitation in 30 days, percentile 90%
- public exploits
- 0
- none known
Summary
The BeanShell components of IRISNext through 9.8.28 allow execution of arbitrary commands on the target server by creating a custom search (or editing an existing/predefined search) of the documents. The search components permit adding BeanShell expressions that result in Remote Code Execution in the context of the IRISNext application user, running on the web server.
Exploit prediction
4.19% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2022-26111.pdf referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement
References
-
github.com
/post-cyberlabs/CVE-Advisory/blob/main/CVE-2022-26111.pdf
exploit, third-party-advisory
-
varsnext.iriscorporate.com
/
product, vendor-advisory
Sources
- CVE List CVE-2022-26111
- NVD CVE-2022-26111
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.