What is CVE-2026-67919?
A critical vulnerability in Halo version 2.25.4 allows remote code execution (RCE) via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components. Immediate update to the latest version is strongly recommended.
Azərbaycanca: Halo 2.25.4 versiyasında aşkar edilmiş kritik boşluq uzaqdan kod icrasına (RCE) imkan verir. Problem PluginEndpoint.java, installFromUri metodu və DefaultPluginApplicationContextFactory komponentləri vasitəsilə istismar oluna bilər. Təsirə məruz qalan sistemlərin dərhal son versiyaya yenilənməsi tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-94
FAQ2
Which version of Halo is affected by CVE-2026-67919?
The CVE-2026-67919 vulnerability was identified in Halo version 2.25.4.
How can the CVE-2026-67919 vulnerability be exploited?
This vulnerability, which enables Remote Code Execution (RCE), can be exploited through the installFromUri method in the PluginEndpoint.java file and the DefaultPluginApplicationContextFactory components.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.