CVE-2026-22444

CVE-2026-22444 describes an input validation vulnerability in the "create core" API of Apache Solr versions 8.6 through 9.10.0. This flaw allows authenticated, low-privilege users to bypass Solr's "allowPaths" security setting, potentially leading to the use of unexpected configsets and, on Windows systems, NTLM hash disclosure. The vulnerability has a CVSS score of 7.1 (High), indicating a network-based attack with low attack complexity and low privileges required, resulting in high confidentiality impact and low integrity impact. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the CVE has garnered significant community discussion with 10 mentions.