Loading story…
A critical vulnerability, CVE-2025-46295, has been identified in Apache Commons Text, allowing for potential remote code execution when untrusted input is passed into the text-substitution API. The flaw, which affects versions prior to 1.10.0, stems from the abuse of interpolation features that could trigger command execution or access to external resources. Security researchers warn that exploitation of this vulnerability could result in total server takeover if left unpatched, and the issue has been fully addressed in FileMaker Server 22.0.4.
Organizations using Apache Commons Text in their applications are urged to update to the latest version to mitigate the risk. The vulnerability has been rated with a CVSS score of 9.8, underscoring its severity and the urgency for remediation. No specific products have been listed as affected yet, but the risk applies broadly to any software leveraging vulnerable versions of the library.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2025-46295 was published as a critical Apache Commons Text vulnerability with a CVSS 3.1 score of 9.8, indicating remote exploitability without user interaction or privileges. Public advisories warned that vulnerable applications could face command injection and possible remote code execution.
Claris addressed the vulnerability in FileMaker Server version 22.0.4 by updating the bundled Apache Commons Text library to a fixed release. The issue was described as fully addressed in that version.
Claris FileMaker credited an anonymous researcher with responsibly reporting a critical command injection/remote code execution issue in Apache Commons Text affecting versions prior to 1.10.0. The flaw stems from unsafe interpolation features that can be abused when untrusted input is processed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Authorities warned of **critical vulnerabilities** in **GitLab Community Edition and Enterprise Edition** and the **Apache Commons Text** component that could be exploited remotely over a network. In both cases, the flaws were described as reachable **without physical access**, requiring **no user interaction** and **no prior authentication**, making internet-exposed systems particularly at risk. The advisories indicate that attackers could target the vulnerable software directly rather than relying on phishing or stolen credentials, raising the likelihood of rapid opportunistic exploitation. Organizations using affected GitLab deployments or applications that include Apache Commons Text were urged to identify exposed assets quickly and prioritize remediation because the weaknesses could enable severe compromise through unauthenticated remote attacks.
Jun 29, 2026
A high-severity vulnerability (CVE-2025-64403) was identified in Apache OpenOffice Calc, where remote documents could be loaded automatically via "external data sources" without prompting the user. This missing authorization flaw affects versions up to 4.1.15 and could allow attackers to craft malicious spreadsheet files that retrieve external content, potentially exposing users to further attacks or data exfiltration. The issue was addressed in version 4.1.16, and users are strongly advised to update to the latest release to mitigate the risk. In addition to this specific vulnerability, Apache OpenOffice released a security update addressing a total of seven flaws, including memory corruption issues and the unprompted remote content loading vulnerability. The coordinated disclosure and patch highlight the importance of keeping productivity software up to date, as attackers increasingly target document-based vectors for initial access and exploitation. Organizations using OpenOffice should review their deployment and ensure all instances are patched promptly.
Jun 29, 2026
A critical remote code execution (RCE) vulnerability, identified as CVE-2025-54539, has been discovered in the Apache ActiveMQ NMS AMQP Client. This flaw is rated with a CVSS 3.1 score of 9.8, indicating its severe impact and ease of exploitation. The vulnerability arises from the deserialization of untrusted data within the NMS AMQP Client component, which can allow attackers to execute arbitrary code on the server. Security researchers have confirmed that successful exploitation of this vulnerability could lead to full server-side code execution, potentially granting attackers complete control over affected systems. The issue specifically affects deployments using the NMS AMQP Client, a component commonly integrated into enterprise messaging infrastructures. Organizations relying on Apache ActiveMQ for message brokering are at heightened risk if they utilize the vulnerable client library. The vulnerability can be exploited remotely, requiring no prior authentication, which significantly increases the attack surface and urgency for remediation. Security advisories recommend immediate patching or mitigation to prevent exploitation in the wild. The flaw was publicly disclosed on October 16, 2025, prompting rapid response from the Apache ActiveMQ development team and the broader security community. No reports of active exploitation have been confirmed at the time of disclosure, but the critical nature of the bug has led to widespread concern among enterprise users. Technical analysis indicates that the vulnerability stems from improper handling of serialized objects received over the AMQP protocol. Attackers can craft malicious payloads that, when processed by the vulnerable client, trigger arbitrary code execution. The Apache Software Foundation has released updated versions of the NMS AMQP Client to address the issue and urges all users to upgrade immediately. Security experts highlight the importance of reviewing all systems for the presence of the affected library and applying compensating controls where patching is not immediately feasible. The vulnerability underscores the ongoing risks associated with deserialization flaws in widely used open-source components. Organizations are advised to monitor for indicators of compromise and to review their application architectures for similar risks. The incident serves as a reminder of the critical need for secure coding practices and regular vulnerability management in enterprise environments.
Jun 29, 2026