CVE-2026-82384: Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint
Apache Roller 6.1.5 has unauthenticated XML-RPC deserialization rated CVSS 9.8.
64
Vulnerability7 · 5 reads
CVE-2026-82384
Unauthenticated deserialization RCE in Apache Roller 6.1.5
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Roller 6.1.5 deserializes untrusted data on its XML-RPC endpoint before authentication. An unauthenticated remote attacker can send attacker-controlled bytes that are parsed as vendor extension types, and the servlet is mapped unconditionally, so this happens even when the global XML-RPC feature is disabled and no non-default configuration is required. Successful exploitation can lead to remote code execution on the Roller server. Installations running Apache Roller 6.1.5 are affected; the vendor recommends upgrading to 6.1.6 or later. There is no known public proof of concept, and the issue is not listed in the CISA KEV catalog.
What to do: Upgrade to Apache Roller 6.1.6 or later, which disables the XML-RPC vendor extension types and rejects requests when the XML-RPC feature is disabled. Turning the XML-RPC feature off is not sufficient on 6.1.5, because the servlet is still mapped and parses requests before authentication. After upgrading, confirm the instance no longer accepts those extension-type requests and review logs for unexpected XML-RPC traffic.
| Product | Affected |
|---|---|
| Apache Software Foundation Apache Roller | 6.1.5 |
Estimated exposure
nichelikely well under 10,000 internet-facing servers (order-of-magnitude estimate, not a measured count) — No install census, market-share figure, or internet-scan total is in the advisory; Apache Roller is a long-standing but low-adoption self-hosted Java blog server rather than a mass CMS, so the exposed population is a qualitative niche…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is mapped unconditionally, so parsing occurs even when the global XML-RPC feature is set to disabled; no non-default configuration is required for this path. This can lead to remote code execution. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which disables the extension types and rejects requests when the XML-RPC feature is disabled.
- Weakness
- CWE-502
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H