PT-2026-22728 · Apache · Apache Ranger

Chengtianyi · Published 2026-03-03 · Updated 2026-03-08 · CVE-2025-59059

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 2.8.0

Description A Remote Code Execution issue exists in the NashornScriptEngineCreator component of Apache Ranger. An unauthenticated remote attacker may be able to execute code on the system.

Recommendations Upgrade to version 2.8.0 or later to resolve this issue.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-59059

GHSA-C87W-642H-M97H

Affected Products

Apache Ranger

References · 14

• https://lists.apache.org/thread/z47q86rho80390lf2qcmoc2josvs0gtv · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c87w-642h-m97h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59059 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59059 · Security Note
• https://github.com/apache/ranger · Note
• http://openwall.com/lists/oss-security/2026/03/02/5 · Note
• https://twitter.com/infoflowcloud/status/2028799088079089703 · Twitter Post
• https://twitter.com/TheHackerWire/status/2028862923461050507 · Twitter Post
• https://twitter.com/oss_security/status/2030573061838086446 · Twitter Post
• https://twitter.com/CVEnew/status/2028796742439686383 · Twitter Post
• https://twitter.com/TheHackerWire/status/2028857119685165489 · Twitter Post
• https://twitter.com/TheHackerWire/status/2028857421821800549 · Twitter Post
• https://twitter.com/CCBalert/status/2029222776414912991 · Twitter Post
• https://t.me/CVEtracker/46196 · Telegram Post