CVE-2016-15057 json
Apache Continuum: Command injection leading to RCE
published 2026-01-26 9 mo ago modified 2026-06-17 4 mo ago also GHSA-77p9-w6pj-rmvg , EUVD-2016-10802
- cvss
- 9.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.9%
- EPSS 3.9% chance of exploitation in 30 days, percentile 90%
- public exploits
- 1
- Metasploit
Summary
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum.
This issue affects Apache Continuum: all versions.
Attackers with access to the installations REST API can use this to invoke arbitrary commands on the server.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Timeline
- First public exploit (Metasploit exploit/linux/http/apache_continuum_cmd_exec)
- Published
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 9 mo ago
Exploit prediction
3.89% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/linux/http/apache_continuum_cmd_exec Apache Continuum Arbitrary Command Execution metasploit exploit, excellent rank, 2016-04-06
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| CNA | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.continuum:continuum | <=1.4.2 |
no fix listed |
Affected products
- Apache Software Foundation Apache Continuum
Classification
- Weakness
-
- CWE-77 Improper Neutralization of Special Elements used in a Command
References
-
lists.apache.org
/thread/hbvf1ztqw2kv51khvzm5nk3mml3nm4z1
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2026/01/26/1
web, mailing-list, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2016-15057
advisory
-
github.com
/apache/continuum
package
Sources
- CVE List CVE-2016-15057
- GitHub Advisory GHSA-77p9-w6pj-rmvg
- NVD CVE-2016-15057
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.