« Volver al listado

CVE-2026-6009

Estado: Pendiente de análisisAlta (8.7)—

Java Deserialisation Vulnerability in Jaspersoft Reports Library leads to Remote Code Execution (RCE), potentially allowing code execution on the affected system

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

CWE-502 (deserialización insegura en Java) + acceso en red con PR:L permite explotación de servicios remotos; VC:H/VI:H/VA:H confirma ejecución de código remota.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementDisable or Remove Feature or ProgramVulnerability ScanningThreat Intelligence ProgramRestrict Web-Based ContentNetwork Segmentation

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Jaspersoft — Jaspersoft ReportsAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-6009",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-6009",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-19T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "db6d2600-d19b-4111-a010-f3c4ed70cd50",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.7,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "db6d2600-d19b-4111-a010-f3c4ed70cd50",
      "affectedData": [
        {
          "vendor": "Jaspersoft",
          "product": "JasperReports Library Community Edition",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "Patch",
              "lessThanOrEqual": "7.0.6"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Jaspersoft",
          "product": "Jaspersoft Studio Community Edition",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "Patch",
              "lessThanOrEqual": "7.0.6"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Jaspersoft",
          "product": "JasperReports Server",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "Patch",
              "lessThanOrEqual": "10.0.0"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Jaspersoft",
          "product": "JasperReports Library Professional",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "Patch",
              "lessThanOrEqual": "10.0.0"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Jaspersoft",
          "product": "Jaspersoft Studio Professional",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "Patch",
              "lessThanOrEqual": "10.0.0"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Jaspersoft",
          "product": "JasperReports IO Professional",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "Hotfix",
              "lessThanOrEqual": "10.0.0"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Jaspersoft",
          "product": "JasperReports IO At-Scale",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "Hotfix",
              "lessThanOrEqual": "10.0.0"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Jaspersoft",
          "product": "JasperReports Web Studio",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "Hotfix",
              "lessThanOrEqual": "10.0.1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-05-19T18:16:29.613",
  "references": [
    {
      "url": "https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-may-19-2026-jaspersoft-library-cve-2026-6009-r11/",
      "source": "db6d2600-d19b-4111-a010-f3c4ed70cd50"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "db6d2600-d19b-4111-a010-f3c4ed70cd50",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Java Deserialisation Vulnerability in Jaspersoft Reports Library leads to Remote Code Execution (RCE), potentially allowing code execution on the affected system"
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Deserialización de Java en la biblioteca de Jaspersoft Reports conduce a Ejecución Remota de Código (RCE), lo que podría permitir la ejecución de código en el sistema afectado"
    }
  ],
  "lastModified": "2026-07-24T08:10:00.150",
  "sourceIdentifier": "db6d2600-d19b-4111-a010-f3c4ed70cd50"
}