THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-27727 (CRITICAL 9.8) — mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running application. If an attack

[NVD] CVE-2026-27727 (CRITICAL 9.8) — mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running application. If an attack

lownvdPublished 2026-02-25

CVE-2026-27727 CVSS: 9.8 CRITICAL Published: 2026-02-25T17:25:39.910

mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running application. If an attacker can provoke an application to read a maliciousl

Indicators of compromise

CVE-2026-27727cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-27727