CVE-2026-42785
OpenKM 6.3.12 Remote Code Execution via Administrative Scripting
Vexday Risk Score
41Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 8.6EPSS 0.7%KEV nãoPoC públicaNuclei —Metasploit —Patch referenciado
Lifecycle
26 May 2026Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system commands in the context of the OpenKM application server.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
public PoCs found — 1
cve_referencewww.exploit-db.com/exploits/52520unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
https://github.com/terrasystemlabs/Exploits/tree/main/OpenKM-Exploitshttps://github.com/terrasystemlabs/Exploits/tree/main/OpenKM-Exploits/nuclei-templates/openkm-remote-code-executionhttps://hub.docker.com/r/openkm/openkm-cehttps://terrasystemlabs.com/post?slug=openkm-zero-day-vulnerabilities-terra-system-labshttps://www.exploit-db.com/exploits/52520https://www.openkm.com/https://www.vulncheck.com/advisories/openkm-remote-code-execution-via-administrative-scripting