CVE-2026-62392Patch(apache / kylin)

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch apache kylin systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API may bring job config parameters to OS command line. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which fixes the issue.

apache CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

kylin

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
6 mentions across 4 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 4 signals
Technical details provided in 6 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 3d ago at 2 mentions (2026-07-14); latest day: 1
6 total mentions across 4 days

Affected systems

Vendors

apache

Products

kylin

Deep dive

Activity timeline6 mentions / 4d

Signal classification3 categories

Patch

350.0%

Disclosure

233.3%

General

116.7%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-14	2	General1Patch1
2026-07-16	2	Disclosure2
2026-08-08	1	Patch1
2026-08-13	1	Patch1

Full discourse6 posts

Open Source Security mailing list@oss_security91d
General
Apache Kylin CVE-2026-62390: SQL Injection in Catalog Cache Refresh API https://openwall.com/lists/oss-security/2026/07/14/4 CVE-2026-62392: OS Command Injection via Async Query API https://www.openwall.com/lists/oss-security/2026/07/14/5 Both "Severity: important" Kylin is a high concurrency, high performance and intelligent OLAP engine
Post summary
The passage lists two Apache Kylin CVEs with an "important" severity, describing SQL injection and OS command injection vulnerabilities, but provides no evidence of exploitation, tools, or patches.
11020869
4.7K followersView on X
Stanislav Klevtsov@stansecure61d
Patch
Top #CVE to #patch this week 👀 - @VMware #ESXi 9.0 RCE (CVE-2026-47876, CVE-2026-41703) - @JetBrains #TeamCity RCE (CVE-2026-63077, CVE-2026-65907) - #Jenkins Core (CVE-2026-70426) - @zohocorp ManageEngine ADAudit RCE (CVE-2026-6516) - @IBM Langflow RCE (CVE-2026-9198) - @ApacheKylin OS command injection (CVE-2026-62392) - #MOVEit auth bypass (CVE-2026-4670) - @giteaio unauth file read (CVE-2026-59774)
Post summary
The tweet lists several newly disclosed CVEs classified as RCE or related issues, urging users to patch them this week, but it does not provide exploit code, patch details, or evidence of active exploitation.
1000073
44 followersView on X
takenaka hiroya@Joe_Biden_ja66d
Patch
Apache Kylin のバックエンドAPIが、ジョブ設定のパラメータを検証せずOSのコマンドラインへ渡していました。特権も利用者操作も不要で任意コマンド実行。影響は4から5.0.3、修正は5.0.4。公式の回避策は無く、更新までは管理APIの露出を切るしかありません。 https://cve.autoarticles.net/cve/CVE-2026-62392
Post summary
CVE‑2026‑62392 permits arbitrary command execution in Apache Kylin 4–5.0.3; the issue is fixed in 5.0.4, with no interim work‑arounds other than disabling the management API.
0000084
562 followersView on X
SecAlerts@SecAlertsCo88d
Disclosure
Apache Kylin hit with a CVSS 9.8 OS command injection (CVE-2026-62392). Job config params in the Async Query API flow straight to the OS command line, no auth needed. Patch now. 🪨 #Apache #AppSec https://secalerts.co/vulnerability/CVE-2026-62392?utm_campaign=x https://t.co/nqTIvDtM7o
Post summary
Apache Kylin is affected by CVE‑2026‑62392, an OS command‑injection flaw with a CVSS of 9.8 that requires no authentication. A patch is now available.
00000150
858 followersView on X
ThreatAft@ThreatAft89d
Disclosure
🚨 Critical Apache Kylin SQLi + Command Injection (CVE-2026-62390 & CVE-2026-62392, CVSS 9.8) Unauth attackers can exfiltrate data and execute arbitrary commands. Upgrade to Kylin 5.0.4 now. 🔗 https://threataft.com/articles/apache-kylin-sql-injection-command-injection-cve-2026-62390-cve-2026-62392?utm_source=twitter&utm_medium=social&utm_campaign=share #CyberSecurity #ThreatIntel
Post summary
The tweet announces critical SQL injection and command injection vulnerabilities in Apache Kylin, provides CVSS scores, and urges users to upgrade to version 5.0.4.
00000101
34 followersView on X
Atlas Threat Monitoring@ThreatAtlas90d
Patch
Unpatched vulnerabilities don't stay hidden on our atlas. #CVE CRITICAL VULNERABILITY DETECTED CVE ID → CVE-2026-62392 Vendor → Apache Severity → Critical — CVSS 9.8 Product → Kylin Date → 2026-07-14 A critical vulnerability (OS Command Injection) has been disclosed affecting Kylin. Patch immediately. Powered by @Brandefense #ThreatIntel #CyberSecurity #CVE #Apache
Post summary
The post highlights a critical OS command injection flaw in Apache Kylin (CVE-2026-62392) and calls for prompt patching.
00000150
26 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	kylin	-	-	-

Explore more

Back to dashboard apache CVEs kylin vulnerabilities

What researchers are saying

CVE-2026-62392

Stanislav Klevtsov[verified]@stansecurePatch

The tweet lists several newly disclosed CVEs classified as RCE or related issues, urging users to patch them this week, but it does not provide exploit code, patch details, or evidence of active exploitation.

Atlas Threat Monitoring[verified]@ThreatAtlasPatch

The post highlights a critical OS command injection flaw in Apache Kylin (CVE-2026-62392) and calls for prompt patching.

Open Source Security mailing list@oss_securityGeneral

The passage lists two Apache Kylin CVEs with an "important" severity, describing SQL injection and OS command injection vulnerabilities, but provides no evidence of exploitation, tools, or patches.

takenaka hiroya@Joe_Biden_jaPatch

CVE‑2026‑62392 permits arbitrary command execution in Apache Kylin 4–5.0.3; the issue is fixed in 5.0.4, with no interim work‑arounds other than disabling the management API.

SecAlerts@SecAlertsCoDisclosure

Apache Kylin is affected by CVE‑2026‑62392, an OS command‑injection flaw with a CVSS of 9.8 that requires no authentication. A patch is now available.

ThreatAft@ThreatAftDisclosure

The tweet announces critical SQL injection and command injection vulnerabilities in Apache Kylin, provides CVSS scores, and urges users to upgrade to version 5.0.4.