THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-12894 (HIGH 8.8) — A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java

[NVD] CVE-2026-12894 (HIGH 8.8) — A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java

mednvdPublished 2026-08-31

CVE-2026-12894 CVSS: 8.8 HIGH Published: 2026-08-31T13:17:20.753

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types

Indicators of compromise

CVE-2026-12894cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-12894