CVE-2019-17560

CVE-2019-17560 describes a critical vulnerability in the Apache NetBeans autoupdate system, affecting versions up to and including 11.2, as well as Oracle NetBeans and GraalVM. The flaw stems from a lack of SSL certificate and hostname validation for HTTPS-based downloads, allowing an attacker to intercept and modify update files, potentially injecting malicious code. With a CVSS score of 9.1 (CRITICAL), this vulnerability is easily exploitable over the network with low attack complexity, leading to high confidentiality and integrity impacts. Despite its severity, there is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.