Skip to content
feed: live
0dayNews
CVE Record
[ CRITICAL ]CVE-2026-82384

Apache Roller XML-RPC Deserialization Allows Unauthenticated RCE

Deserialization of untrusted data in Apache Roller 6.1.5 XML-RPC endpoint lets an unauthenticated attacker execute arbitrary code remotely. CVSS 9.8 critical.

cat cve-2026-82384.json
Vendor
Apache Software Foundation
Product
Apache Roller
CVSS
9.8
EPSS (exploit probability)
1.0%
Status
patched
Published
Source
https://nvd.nist.gov/vuln/detail/CVE-2026-82384

Is CVE-2026-82384 being exploited?

Not on any exploited-vulnerability catalog we track. CVE-2026-82384 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.

FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.0% (scored October 25, 2026).

Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison

CVE-2026-82384 timeline

  1. Published to NVD
  2. First 0dayNews coverage+1d

Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON

CVE-2026-82384 is a deserialization of untrusted data vulnerability in Apache Roller 6.1.5. The XML-RPC endpoint accepts vendor-extended method calls and deserializes attacker-controlled bytes, allowing an unauthenticated remote attacker to execute arbitrary code on the server.

No authentication is required to reach the XML-RPC endpoint, which is commonly exposed on public-facing Roller installations.

What to do: Upgrade Apache Roller to a patched version. If an immediate upgrade is not possible, restrict external access to the XML-RPC endpoint at the network layer. See the NVD record and the Apache Roller GitHub fix for details.

Other Apache Software Foundation CVEs we track

CVE / VulnerabilitySeverityCVSSEPSSAdded to KEV
CVE-2026-90910
Apache Answer Missing Auth on Reaction APIwrite-up
[ CRITICAL ]9.80.5%—
CVE-2026-82383
Apache Roller Missing Auth Lets Attackers Change Site Configurationwrite-up
[ HIGH ]8.20.5%—
CVE-2026-82379
Apache Roller WSSE Auth Bypass via Digest Replaywrite-up
[ HIGH ]7.70.4%—
CVE-2026-82378
Apache Roller OAuth 1.0a Authorization Bypass Allows Token Theftwrite-up
[ CRITICAL ]9.00.4%—
Related coverage
~/articles/2026-09-29-apache-roller-four-cves-patched
apache

Apache Roller Patches Critical XML-RPC Deserialization Bug

Apache Roller 6.1.5 has four patched vulnerabilities, including a CVSS 9.8 deserialization flaw allowing unauthenticated RCE via the XML-RPC endpoint.

read →