—

CVE-2026-44416PATCHED

apache · ranger

Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation

Description

Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

Affected Products

Vendor	Product	Versions
apache	ranger	0

References

https://lists.apache.org/thread/2gqssqhwkzbpd8jx8q6986cwldr7qkdn(vendor-advisory)

Related News (2 articles)

Tier D

CSO Online1d ago

Nucleus wants to get ahead of scanners on new vulnerabilities

→ No new info (linked only)

Tier C

VulDB17d ago

CVE-2026-44416 | Apache Ranger externally-controlled input to select classes or code

→ No new info (linked only)

CISA KEV❌ No

Actively exploited❌ No

Patch available

https://lists.apache.org/thread/2gqssqhwkzbpd8jx8q6986cwldr7qkdn

CWECWE-94, CWE-470

PublishedAug 10, 2026

Trending Score42

Source articles2

Independent2

Info Completeness0/14

Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

NONECVE-2026-53434EXP

Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector

Trending: 34

HIGHCVE-2026-57819

Apache CXF: No default restriction on the amount of form parameters per message

Trending: 31

HIGHCVE-2026-54225

Apache CXF: Denial of Service attack via large attachments

Trending: 31

HIGHCVE-2026-64958

Apache CXF: Denial of service via message header attachments

Trending: 31

CRITICALCVE-2026-59084EXP

Apache Tomcat: EncryptInterceptor requirements not clearly documented

Trending: 28

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Aug 10, 2026

Discovered by ZDM

Aug 10, 2026

Patch Available

Aug 12, 2026