Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing existing protections against CVE-2025-11226 by compromising an existing logback configuration file or by injecting an environment variable before program execution. A successful attack requires the presence of Janino library to be present on the user's class path. In addition, the attacker must have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege. Please note that in logack version 1.5.37 conditional processing using Janino was removed.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
A lot of offensive activities were identified targeting http://QOS.CH Sarl Logback-core (CVE-2026-13006) https://vuldb.com/vuln/373176/cti
Post summary
The post notes that numerous offensive actors are targeting Logback‑core CVE‑2026‑13006, but it offers no further details on exploitation, patches, or technical specifics.
🚨 HIGH - Logback conditional config arbitrary code execution bypass (CVE-2026-13006) An arbitrary code execution vulnerability exists in http://QOS.CH logback-core’s conditional configuration file processing (logback.xml / logback-test.xml) up to and including 1.5.34, enabling a bypass of protections introduced for CVE-2025-11226. The root cause is improper input validation / sandbox bypass in conditional evaluation when Janino is available, allowing attacker-controlled expressions or configuration logic to be evaluated. An attacker can exploit this if Janino is on the classpath and they already have the ability to write/modify a Logback configuration file or inject an environment variable/property that points Logback to a malicious configuration file. If exploited, this results in arbitrary code execution in the context of the running Java process, enabling full application compromise, data access, and potential lateral movement. 👉 Affected: logback-core <= 1.5.34 | Upgrade to 1.5.35 or later
Post summary
CVE‑2026‑13006 is an arbitrary code execution flaw in Logback’s conditional configuration processing; it can be mitigated by upgrading to version 1.5.35 or later.