Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-59059: Apache Ranger: Malicious code can run on your system

CVE-2025-59059 · published 8 months ago

Summary

Apache Ranger versions up to 2.7.0 can allow attackers to run unauthorized code on your system, potentially giving them control over your data. This is a serious risk, especially if you're using sensitive or confidential information. To fix this, update to version 2.8.0 or later.

What to do

Update apache org.apache.ranger:ranger-plugins-common to version 2.8.0.
Update apache ranger to version 2.8.0 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
maven	apache	org.apache.ranger:ranger-plugins-common	< 2.8.0 Fix: upgrade to 2.8.0
–	apache	ranger	< 2.8.0 `cpe:2.3:a:apache:ranger::::::::`

Original advisory text

Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator

Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0.
Users are recommended to upgrade to version 2.8.0, which fixes this issue.

References

https://github.com/advisories/GHSA-c87w-642h-m97h
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59059... Vendor Advisory
https://lists.apache.org/thread/z47q86rho80390lf2qcmoc2josvs0gtv Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-59059 Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/03/02/5 URL

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

1% chance of attack within 30 days

Type

CWE-94Code Injection

Timeline

Published3 Mar 2026

Updated3 Nov 2026

First seen6 Mar 2026

Sources

CVE-2025-59059 · NVD

GHSA-c87w-642h-m97h · GHSA

CVE-2025-59059 · OSV

Track software like this

Free during beta