CVE-2026-78254
HIGHCVE-2026-78254 is a high-severity (CVSS 7.4) CWE-23 vulnerability in apache ant. O3 Security detects and blocks CVE-2026-78254 exploitation at runtime via eBPF exploit-chain detection and L7 egress monitoring, even on unpatched systems.
The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory…
Exploitation Status
No confirmed exploitation observed yet
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-78254.
Description
The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the user running Ant in versions prior to Ant 1.10.18.
In order to exploit this vulnerability, the server would either have to be malicious or be subject to a machine-in-the-middle attack. Additionally in the case of scp or the ftp task using ftps the server must pass the server identity checks performed by the tasks.
For ftp tasks not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files.
Starting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default. An option is available to disable this behavior in the unlikely case that the old behavior is required by existing build files.
Mitigations:
Users of scp and ftp (when using ftps) in any version of Ant should not bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible.
All users are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue.
Affected Products
antapacheDetection & mitigation playbook
Vendor / applianceDetect
Inventory every apache ant deployment and check each version against the affected-products list above. Because the exploit targets the running system rather than your application code, also watch for exploitation at the network and runtime layer — O3 flags the exploit behaviour from runtime telemetry and egress traffic even before a vulnerable build is confirmed.
Fix
Apply the apache ant security patch or hotfix for CVE-2026-78254 on the affected version, following the vendor advisory for your exact build.
Workarounds
Cut exposure now: restrict the management/admin interface to trusted networks, segment the device, and apply the vendor's recommended configuration mitigations and any WAF/IPS signature. O3's runtime protection blocks the exploit chain at execution, holding the line on unpatched or end-of-life systems until you can patch.
How O3 protects you
O3 detects and blocks CVE-2026-78254 exploitation at runtime: eBPF exploit-chain detection, plus L7 egress monitoring that catches the post-exploitation callback and severs the attacker's outbound channel.
Tailored to CVE-2026-78254. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-78254 being exploited in your environment?
O3's eBPF runtime sensors and L7 egress monitoring detect and block the CVE-2026-78254 exploit chain at execution — protecting unpatched and end-of-life systems until the vendor patch is applied.