CVE-2026-44825PoC(apache / solr)

HIGHCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 7 mentions and remains active

Immediate actions

Patch apache solr systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account. As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue. Not affected: * Clusters where bin/solr auth enable was not used to bootstrap BasicAuth * Clusters where template users have been assigned strong passwords after bootstrap

apache CVEs Back to dashboard

7.8/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-798CWE-1188

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

RISING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

solr

Threat summary

Active exploitation appears in 1 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
20 mentions across 11 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 2 signals
PoC mentioned or linked in 9 signals
Patch or workaround mentioned in 4 signals
Technical details provided in 9 signals
Disclosure: 4 classified signals
General: 4 classified signals
Peaked 1d ago at 7 mentions (2026-07-22); latest day: 1
20 total mentions across 11 days

Affected systems

Vendors

apache

Products

solr

1 version affected across 1 product

Deep dive

Activity timeline20 mentions / 11d

Signal classification5 categories

PoC

840.0%

Disclosure

420.0%

General

420.0%

Patch

315.0%

Active Exploitation

15.0%

Referenced assets10 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-29	1	Disclosure1
2026-06-01	2	General1Patch1
2026-06-02	1	General1
2026-06-03	2	Patch2
2026-06-12	2	Disclosure2
2026-06-24	1	General1
2026-07-05	1	PoC1
2026-07-09	1	PoC1
2026-07-10	1	General1
2026-07-22	7	Active Exploitation1PoC6
2026-07-29	1	Disclosure1

Full discourse20 posts

Dark Web Informer@DarkWebInformer96d
PoC
💥 CVE-2026-44825: A scanner for Apache Solr instances that may be affected by CVE-2026-44825, related to Velocity Template Remote Code Execution (RCE) conditions. GitHub: https://github.com/gagaltotal/CVE-2026-44825-Apache-Solr-Scanner https://t.co/hYH6hYsDQN
Post summary
The post announces a GitHub repo containing a scanner targeting the Velocity Template RCE (CVE-2026-44825) in Apache Solr, without evidence of active exploitation, patching, or false positives.
12201276020.4K
234.6K followersView on X
dbugs@ptdbugs100d
PoC
A PoC/exploit has been discovered for vulnerability CVE-2026-44825 PT ID: PT-2026-45073 Vendor: Apache Software Foundation Product: Apache Solr Description: Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account. As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords. The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue. Not affected: * Clusters where bin/solr auth enable was not used to bootstrap BasicAuth * Clusters where template users have been assigned strong passwords after bootstrap Link: https://github.com/shinthink/solrradar #dbugs_vuln
Post summary
A PoC/exploit for CVE-2026-44825, exposing hardcoded credentials in Apache Solr, has been released. Immediate mitigations include deleting or resetting template users and upgrading to newer, non‑vulnerable versions.
0602442.0K
3.4K followersView on X
yousukezan@yousukezan132d
Patch
Apache Solrの認証設定ツールに、誰でも管理者権限を取得できる危険な脆弱性が見つかった。基本認証を有効化する際に開発者が気付かないまま既知の管理アカウントが作成されるため、公開環境ではクラスタ全体を乗っ取られる恐れがある。 CVE-2026-44825はApache Solr 9.4.0～9.10.1および10.0.0に影響する脆弱性だ。問題はBasic Authentication設定ツール「bin/solr auth enable」にあり、利用者が指定したアカウントとは別に、既知の認証情報を持つテンプレートユーザーが自動的に作成される。その結果、攻撃者は公開されているデフォルト認証情報を利用してクラスタへログインし、管理者権限を取得できる可能性がある。影響を受けるのは、このコマンドラインツールを使用して認証設定を行った環境に限られ、手動でアカウントを作成した環境は対象外とされる。現時点では修正版の9.11.0および10.1.0は未公開のため、Apacheはsecurity.json内のsuperadmin、admin、search、indexといったテンプレートユーザーを削除するか、強力なパスワードへ変更するよう推奨している。 https://securityonline.info/apache-solr-default-credentials-cve-2026-44825/
Post summary
Apache Solr's Basic Authentication enable tool creates a template user with default credentials, enabling attackers to gain admin rights (CVE‑2026‑44825). Apache advises deleting those users or changing passwords and will release patched versions in the near future.
010531.5K
14.5K followersView on X
pdnuclei-bot@pdnuclei_bot76d
Disclosure
🚨 CVE-2026-44825 - high 🚨 Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials > Apache Solr 9.4.0 through 9.10.1 and 10.0.0 contain a hardcoded credentials vulnerabi... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-44825 @pdnuclei #NucleiTemplates #cve
Post summary
The post announces that Solr versions 9.4.0-9.10.1 and 10.0.0 have hardcoded default credentials, but does not provide PoC, exploit tool, or patch information.
01031335
1.1K followersView on X
Open Source Security mailing list@oss_security136d
Disclosure
CVE-2026-44825: Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users https://www.openwall.com/lists/oss-security/2026/05/29/6 Severity: High Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable)
Post summary
The notice announces a new high‑severity CVE (CVE‑2026‑44825) in Apache Solr that introduces hardcoded credentials when enabling BasicAuth, but does not provide a PoC, exploit code, patch, or evidence of active exploitation.
00041522
4.7K followersView on X
Criminal IP@CriminalIP_US123d
Disclosure
🪶Apache Solr CVE-2026-44825: Authentication enabled does not always mean secured CVE-2026-44825 shows how unintended template accounts can remain after Basic Authentication setup in Apache Solr. Criminal IP findings: • 1,154 internet-exposed Solr Admin assets • Solr Admin interfaces discoverable via title: "Solr Admin" • Some exposed assets reveal version clues through admin endpoints or page resources Public Solr Admin exposure gives attackers a starting point for version checks, authentication testing, and further vulnerability analysis. 🔎 Full analysis https://www.criminalip.io/knowledge-hub/blog/35235 #CyberSecurity #ThreatIntelligence #ApacheSolr #CVE #AttackSurface
Post summary
The post announces CVE-2026-44825, a vulnerability in Apache Solr where unintended template accounts can persist after Basic Authentication is enabled, and highlights the widespread public exposure of Solr Admin interfaces as a risk factor.
02010157
4.9K followersView on X
Horizon3.ai@Horizon3ai133d
General
CVE-2026-44825 affects SolrCloud deployments where admins enabled auth using: bin/solr auth enable
Post summary
The text merely states that CVE-2026-44825 affects certain SolrCloud deployments with authentication enabled, providing no further details or context.
11000204
2.8K followersView on X
Lyrie.ai@lyrie_ai83d
PoC
08:19 UTC: Thread live on @lyrie_ai. 0day Intel: A PoC/exploit has been discovered for vulnerability CVE-2026-44825
Post summary
A proof of concept and exploit for CVE-2026-44825 has been discovered, but no active exploitation, patch information, or detailed vulnerability analysis is provided.
1000061
326 followersView on X
Lyrie.ai@lyrie_ai83d
Active Exploitation
11:05 UTC: First exploit attempt in the wild. 0day Intel: A PoC/exploit has been discovered for vulnerability CVE-2026-44825
Post summary
A PoC/exploit for CVE-2026-44825 has been discovered, and the first exploit attempt in the wild was observed at 11:05 UTC.
1000061
326 followersView on X
Lyrie.ai@lyrie_ai83d
PoC
08:05 UTC: CVE-2026-44825 disclosed. A PoC/exploit has been discovered for vulnerability CVE-2026-44825 PT ID: PT-2026-45073 Vendor: Apache Software Founda
Post summary
CVE-2026-44825 was disclosed with a PoC/exploit discovered, but no further technical details, exploitation evidence, or mitigation advice are provided.
1000079
326 followersView on X
Lyrie.ai@lyrie_ai83d
PoC
08:16 UTC: GPT-5 enrichment complete. 68 words. 1 citations. 0day Intel: A PoC/exploit has been discovered for vulnerability CVE-2026-44825
Post summary
A proof‑of‑concept exploit has been discovered for CVE-2026-44825, but no detailed exploit code, active exploitation, or patch information is provided.
1000060
326 followersView on X
Lyrie.ai@lyrie_ai83d
PoC
08:08 UTC: Lyrie Sentinel flagged it. 0day Intel: A PoC/exploit has been discovered for vulnerability CVE-2026-44825
Post summary
The post announces that a proof‑of‑concept or exploit has been discovered for CVE-2026-44825, but offers no further technical details, exploit code, or evidence of active attacks.
1000058
326 followersView on X
Lyrie.ai@lyrie_ai83d
PoC
CVE-2026-44825. 0day Intel: A PoC/exploit has been discovered for vulnerability CVE-2026-44825
Post summary
A proof‑of‑concept/exploit has been found for CVE‑2026‑44825, but the post lacks details on the vulnerability itself, associated fixes, or real‑world exploitation.
1000068
326 followersView on X
Lyrie.ai@lyrie_ai83d
PoC
Vendor v9.4.0. 0day Intel: A PoC/exploit has been discovered for vulnerability CVE-2026-44825
Post summary
A proof‑of‑concept or exploit for CVE‑2026‑44825 has been announced, but no detailed tools, active exploitation, or mitigation steps are provided.
1000052
326 followersView on X
Rıdvan Yağlı@ridvanyagli95d
General
Apache Solr sunucularını CVE-2026-44825 zafiyetine karşı taramak için hazırlanmış araç https://github.com/gagaltotal/CVE-2026-44825-Apache-Solr-Scanner
Post summary
A GitHub repository hosts a scanner tool designed to detect CVE-2026-44825 on Apache Solr servers, but no exploit, patch, or detailed vulnerability information is provided.
00001175
1.2K followersView on X
Criminal IP Japan@CriminalIP_JP123d
Disclosure
🪶Apache Solr CVE-2026-44825 ~「設定済み」が盲点になる脆弱性~ 2026年6月、Apache SolrのBasic Authentication設定ツールに関連する脆弱性CVE-2026-44825が公開されました。 CVSS 9.8（Critical）の本脆弱性は、Basic Authenticationを有効化した環境でも発生し得る認証構成の問題です。 bin/solr auth enable 設定時に、意図しないテンプレートユーザーが生成される可能性があります。その状態でSolr Adminが外部公開されている場合、管理者権限での不正アクセスにつながるおそれがあります。 Criminal IPのIT資産検索では、title: "Solr Admin" クエリにより1,154件の外部公開資産を確認。インデックスデータの漏洩・検索結果の改ざん・内部構造の露出など、影響は多岐にわたります。 ✅ 今すぐ確認・security.jsonのテンプレートユーザー有無・Solr Adminの外部公開状況・認証ログの異常アクセス 📄 詳細はこちら https://www.criminalip.io/ja/knowledge-hub/blog/9113 #ApacheSolr #脅威インテリジェンス #脆弱性 #サイバーセキュリティ
Post summary
The notice announces CVE-2026-44825, a critical Apache Solr Basic Auth configuration flaw that can create unintended privileged users and enable unauthorized admin access, especially for externally exposed Solr Admin endpoints.
00010148
1.4K followersView on X
SecAlerts@SecAlertsCo134d
Patch
Critical: Apache Solr 9.4.0-9.10.1 & 10.0.0 ships hardcoded credentials via bin/solr auth enable, handing remote attackers full admin access. No auth, no interaction needed. CVE-2026-44825 — patch or migrate now. https://secalerts.co/vulnerability/CVE-2026-44825 https://t.co/x1qaYasLRp
Post summary
Apache Solr versions 9.4.0‑9.10.1 and 10.0.0 contain hardcoded credentials that grant unrestricted admin access; immediate patching or migration is required. The linked advisory provides further details and remediation guidance.
00010112
826 followersView on X
IntegSec@integ_sec111d
General
CVE-2026-44825: Apache Solr Hardcoded Credentials Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04mtM3y0
Post summary
The snippet is merely a headline linking to an article about CVE-2026-44825; it does not contain actionable details or definitive information about the vulnerability.
0000040
31 followersView on X
Gray Hats@the_yellow_fall132d
Patch
A high-severity Apache Solr default credentials vulnerability is exposed. Learn the critical CVE-2026-44825 workaround to secure your clusters. #ApacheSolr #CVE202644825 #Cybersecurity #Infosec #DatabaseSecurity https://securityonline.info/apache-solr-default-credentials-cve-2026-44825/ https://t.co/ixPxHxM1JF
Post summary
The tweet alerts to a high‑severity default credentials flaw in Apache Solr (CVE‑2026‑44825) and directs readers to a workaround to secure their clusters, without mentioning exploitation or PoC details.
00000220
12.2K followersView on X
VulDB 🛡@vuldb134d
General
It is possible to see elevated activities targeting Apache Solr (CVE-2026-44825) https://vuldb.com/vuln/367397/cti
Post summary
The text briefly notes possible increased activity targeting Apache Solr’s CVE‑2026‑44825, but offers no concrete evidence of exploitation, PoC, patch, or technical details.
0000080
2.2K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	solr	-	-	-
App	apache	solr	10.0.0	-	-

Explore more

Back to dashboard apache CVEs solr vulnerabilities

What researchers are saying

CVE-2026-44825

dbugs[verified]@ptdbugsPoC

A PoC/exploit for CVE-2026-44825, exposing hardcoded credentials in Apache Solr, has been released. Immediate mitigations include deleting or resetting template users and upgrading to newer, non‑vulnerable versions.

yousukezan[verified]@yousukezanPatch

Apache Solr's Basic Authentication enable tool creates a template user with default credentials, enabling attackers to gain admin rights (CVE‑2026‑44825). Apache advises deleting those users or changing passwords and will release patched versions in the near future.

Criminal IP[verified]@CriminalIP_USDisclosure

The post announces CVE-2026-44825, a vulnerability in Apache Solr where unintended template accounts can persist after Basic Authentication is enabled, and highlights the widespread public exposure of Solr Admin interfaces as a risk factor.

Horizon3.ai[verified]@Horizon3aiGeneral

The text merely states that CVE-2026-44825 affects certain SolrCloud deployments with authentication enabled, providing no further details or context.

Lyrie.ai[verified]@lyrie_aiPoC

A proof of concept and exploit for CVE-2026-44825 has been discovered, but no active exploitation, patch information, or detailed vulnerability analysis is provided.

Lyrie.ai[verified]@lyrie_aiActive Exploitation

A PoC/exploit for CVE-2026-44825 has been discovered, and the first exploit attempt in the wild was observed at 11:05 UTC.

Lyrie.ai[verified]@lyrie_aiPoC

CVE-2026-44825 was disclosed with a PoC/exploit discovered, but no further technical details, exploitation evidence, or mitigation advice are provided.

Lyrie.ai[verified]@lyrie_aiPoC

A proof‑of‑concept exploit has been discovered for CVE-2026-44825, but no detailed exploit code, active exploitation, or patch information is provided.