CVE-2025-26796 is a Cross-site Scripting (XSS) vulnerability (CWE-79) affecting all versions of Apache Oozie. This medium-severity vulnerability (CVSS 5.4) can be exploited with low attack complexity and requires user interaction, potentially leading to limited impact on confidentiality and integrity. As Apache Oozie is a retired project, no fix will be released; users are advised to restrict access or migrate to an alternative. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:a:apache:oozie:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.