Tia N.List

Reported by 2 outlets

Apache Roller pre-auth RCE CVE-2026-82384 (CVSS 9.8)

hot0.0
Why this score
Breadth
1.00 / 2.0 · 2 sources
Authority
1.00 / 2.0 · best outlet weight
Severity
4.50 / 5.0 · CVSS + content signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.59 / 0.6 · time to second source
Recency
× 0.00 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.0 / 10 = base × recency + community
suriq.ioradar.offseq.com CVE-2026-82384 first seen 15d ago

Analysis

Apache Roller 6.1.5 carries a critical pre-authentication remote code execution flaw tracked as CVE-2026-82384, rated CVSS 9.8. The XML-RPC endpoint reads attacker-controlled data before any login check, which allows unauthenticated remote execution. The technical detail comes from suriq.io reporting on the vulnerability. Organizations running Apache Roller 6.1.5 should treat this as an urgent patch priority given the pre-auth nature and high CVSS score.

The event names the exact version (6.1.5), the endpoint (XML-RPC), the CVSS value (9.8), and the authentication boundary (pre-login). There is no mention of observed in-the-wild exploitation in the event content, so exploitation status is unconfirmed. Watch for vendor advisories confirming a patched release or public proof-of-concept code appearing in repositories.

Timeline

  1. original reporting

    Apache Roller 6.1.5 has a critical pre-auth flaw (CVE-2026-82384, CVSS 9.8): its XML-RPC endpoint reads attacker data before any login, allo

    suriq.io · 15d ago · September 28th, 2026

    Apache Roller 6.1.5 has a critical pre-auth flaw (CVE-2026-82384, CVSS 9.8): its XML-RPC endpoint reads attacker data before any login, allo

    via Mastodon https://suriq.io/blog/apache-roller-cve-2026-82384-xmlrpc-rce

  2. update from radar.offseq.com

    Apache Roller 6.1.5 is vulnerable (CVE-2026-82384, CRITICAL, CVSS 9.8): unauthenticated remote deserialization can lead to RCE via XML-RPC —

    radar.offseq.com · 15d ago · September 28th, 2026

    Apache Roller 6.1.5 is vulnerable (CVE-2026-82384, CRITICAL, CVSS 9.8): unauthenticated remote deserialization can lead to RCE via XML-RPC —

    via Mastodon https://radar.offseq.com/threat/cve-2026-82384-cwe-502-deserialization-of-untrusted-data-in-apache-software-foundation-apache-roller-9421d51972b16e3c

Source on GitHub