CVE-2024-56518

CRITICAL 9.8CVE-2024-56518 · Published 17/04/2025 · updated 17/06/2026

In short

CVE-2024-56518 is a CRITICAL (CVSS 9.8) vulnerability affecting management center (hazelcast).
Chance of exploitation in the next 30 days (EPSS): 1.0%, higher than 63.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
management center hazelcast	`≤ 6.0`	No fix yet

Description

Hazelcast Management Center through 6.0 allows remote code execution via a JndiLoginModule user.provider.url in a hazelcast-client XML document (aka a client configuration file), which can be uploaded at the /cluster-connections URI.

References

docs.hazelcast.com/management-center/6.0-snapshot/getting-started/install · Product
gist.github.com/azraelxuemo/c3d42739aa3306a41111ef603dc65b4c · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free