CVE-2026-94301

KRITISCH 9.8CVE-2026-94301 · Published 21/09/2026 · updated 22/09/2026

Kurz gesagt

CVE-2026-94301 ist eine Schwachstelle (KRITISCH (CVSS 9.8)).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.39%, höher als bei 33.5% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the 2.2.X branch only. The 2.0.X and 2.1.X maintenance branches never received the resolveProxyClass() override, so the 2.0.29 and 2.1.13 artifacts listed as fixed -- and every later release on those lines, up to and including the current 2.0.30 and 2.1.14 -- remain vulnerable to the exact allow-list bypass that CVE-2026-47065 was meant to close.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free