Zero Radar
← feed
CriticalVulnerabilityCVE-2026-66088updated 29 Oct 2026, 02:20 UTC

openEQUELLA lets script authors run arbitrary system commands

Anyone allowed to write or edit scripts in openEQUELLA can make the server run any command on the operating system. That can give them control of the server itself, not just the software.

Fixed in openEQUELLA 2026.1Official source
SeverityCriticalCVSS 9.4 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesopenEQUELLA 2026.1 · since 29 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Script authorHas permission to create or edit scripts
  2. 2Malicious scriptCalls system.execute() with a command
  3. 3Command runsNo validation or allow-list applied
  4. 4Service accountCommand runs with service account privileges
  5. ResultAttacker controls the server

What happened

In openEQUELLA before 2026.1, the system.execute() function in the scripting engine runs supplied OS commands without validation or an allow-list of permitted executables.

Why it is dangerous: A user who can create or edit scripts can execute arbitrary commands with the privileges of the openEQUELLA service account, potentially compromising the host and its data.

Are you affected?

You are affected if you run openEQUELLA earlier than 2026.1 and some users can create or edit scripts.

openEQUELLA versions before 2026.1

What to do

  1. Upgrade openEQUELLA to version 2026.1 or later
  2. Until upgraded, restrict script creation and editing to fully trusted administrators
  3. Review who has script edit rights and remove any unnecessary access

Timeline

  1. 29 Oct 2026, 02:16 UTC
    Publicly disclosed
  2. 29 Oct 2026, 02:16 UTC
    Reported by NVD · NVD
  3. 29 Oct 2026, 02:20 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-66088
CVSS
9.4 / 10
Disclosed
29 Oct 2026, 02:16 UTC
On Zero Radar
29 Oct 2026, 02:20 UTC (4 min after disclosure)
Last change
29 Oct 2026, 02:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

openEQUELLA lets script authors run arbitrary system commands · Zero Radar