CVE-2026-46581 — mojarra
HIGHCVE-2026-46581 is a high-severity (CVSS 7.5) Path Traversal vulnerability. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-46581.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Description
In Eclipse Mojarra versions 2.3 and following, URL handing in DefaultFaceletFactory does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as WEB-INF/web.xml or /etc/passwd.
Affected Products
mojarraeclipseDetection & mitigation playbook
VulnerabilityDetect
Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).
Remediation status
The records we use list no fixed release for CVE-2026-46581. Check the upstream advisory for a patched version, and apply the exposure-reduction steps below in the meantime.
Mitigate without a patch
Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform 7.4.25 | see advisory | RHSA-2026:53806 |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap | RHSA-2026:53644 |
| Red Hat JBoss Enterprise Application Platform 8.1.8.GA | org.glassfish/jakarta.faces:4.0.11.SP1-redhat-00001 | RHSA-2026:70277 |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 | eap8-activemq-artemis-0:2.40.0-8.redhat_00024.1.el10eap | RHSA-2026:70230 |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 | eap8-activemq-artemis-0:2.40.0-8.redhat_00024.1.el8eap | RHSA-2026:70228 |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 | eap8-activemq-artemis-0:2.40.0-8.redhat_00024.1.el9eap | RHSA-2026:70229 |
Frequently Asked Questions
Is CVE-2026-46581 in your dependencies?
Find it across your dependency tree, including transitive dependencies.