VulnSocial

CVE-2026-94301Patch

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the  2.2.X branch only. The 2.0.X and 2.1.X maintenance branches never received the resolveProxyClass() override, so the 2.0.29 and 2.1.13 artifacts listed as fixed -- and every later release on those lines, up to and including the current 2.0.30 and 2.1.14 -- remain vulnerable to the exact allow-list bypass that CVE-2026-47065 was meant to close.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 9 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 6 signals
  • Technical details provided in 6 signals
  • Disclosure: 3 classified signals
  • General: 1 classified signal
  • Peaked 2d ago at 5 mentions (2026-09-22); latest day: 1
  • 9 total mentions across 4 days

Deep dive

Activity timeline9 mentions / 4d
01345Mentions · 2026-09-21: 2Mentions · 2026-09-22: 5Mentions · 2026-10-04: 1Mentions · 2026-10-12: 1Patch / Workaround · 2026-09-21: 2Patch / Workaround · 2026-09-22: 2Patch / Workaround · 2026-10-04: 1Patch / Workaround · 2026-10-12: 1Technical Details · 2026-09-21: 1Technical Details · 2026-09-22: 3Technical Details · 2026-10-04: 1Technical Details · 2026-10-12: 109-2109-2210-0410-12
Signal classification3 categories
Patch
555.6%
Disclosure
333.3%
General
111.1%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-09-212
Disclosure1Patch1
2026-09-225
Disclosure2General1Patch2
2026-10-041
Patch1
2026-10-121
Patch1
Full discourse9 posts
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨Critical - Apache MINA Java Proxy Allow-list Bypass Regression (CVE-2026-94301) Apache MINA 2.0.x/2.1.x missed the resolveProxyClass() override that was only applied in 2.2.x for CVE-2026-47065. Attackers can bypass the deserialization allow-list by leveraging java.lang.reflect.Proxy during class resolution, enabling gadget invocation and potential RCE. MINA 2.2.x is not affected. 👉Affected: Apache MINA 2.0.0-2.0.30, 2.1.0-2.1.14

    Post summary

    The post explains a regression in Apache MINA 2.0.x/2.1.x that allows bypass of the deserialization allow-list via Proxy class, leading to potential RCE, and notes that version 2.2.x is not affected, implying a fix via upgrade.

    1001095
    310 followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-94301 Apache MINA: deserialization filter bypass, RCE risk. CVSS 9.8, unpatched on 2.0.x/2.1.x lines despite "fixed" labels. Patch now: https://www.valtersit.com/cve/CVE-2026-94301 #CVE #infosec #Apache #Apache #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The text describes an Apache MINA deserialization filter bypass with RCE risk and a CVSS score of 9.8, and explicitly urges readers to patch. It does not mention a PoC, exploit tool, or active exploitation.

    0001074
    1.1K followersView on X
  • ExploitGrid@exploitgrid
    Disclosure

    [CVE] CVE-2026-94301 [HIGH PRIORITY] #Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.... 🔗 https://exploitgrid.net/cve/CVE-2026-94301

    Post summary

    The text announces CVE-2026-94301 affecting Apache MINA, noting that the resolveProxyClass fix is missing from versions 2.0.X and 2.1.X, with a link to exploitgrid.net for further details. The dual CVE reference (CVE-2026-94301 vs CVE-2026-47065) introduces some ambiguity.

    1000032
    203 followersView on X
  • ExploitGrid@exploitgrid
    General

    🛡️ #ExploitGrid Daily #Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-77521 CVE-2026-79920 CVE-2026-82187 CVE-2026-85751 CVE-2026-94301 ..🧵👇

    Post summary

    The tweet simply lists several CVE identifiers without any description of the vulnerabilities, remediation, or exploitation status.

    1000055
    203 followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 CRITICAL: CVE-2026-94301 (CVSS 9.8) Apache MINA 2.0.X & 2.1.X remain vulnerable to deserialization bypass. Previous fix (CVE-2026-47065) was incomplete—only applied to 2.2.X branch. Versions 2.0.29-2.0.30 & 2.1.13-2.1.14 affected. #CVE #PatchNow https://t.co/01euuoGBVd

    Post summary

    The text announces CVE-2026-94301 in Apache MINA, providing technical details and affected versions, and implies remediation by referencing an incomplete prior fix and affected branches, but does not specify a patched version or active exploitation.

    0000047
    146 followersView on X
  • Anthony Bahn@HoustonIntrove1
    Patch

    Who greenlit MINA 2.0.30 as patched? CVE-2026-94301 says the resolveProxyClass fix never hit 2.0.x or 2.1.x. 2.0.30 and 2.1.14 still take the Proxy/acceptMatchers bypass. Move to 2.0.31, 2.1.15, or 2.2.8+.

    Post summary

    The text identifies CVE-2026-94301 in MINA and states that the resolveProxyClass fix was not included in versions 2.0.30 or 2.1.14. It advises upgrading to corrected versions (2.0.31+, 2.1.15+, 2.2.8+) to mitigate the Proxy/acceptMatchers bypass vulnerability.

    0000035
    38 followersView on X
  • Cybersecurity News DE@cybsecuritynews
    Disclosure

    #schwachstellen Apache MINA: Kritische Lücke CVE-2026-94301 trifft 2.0.x und 2.1.x trotz früherer Korrektur #apachemina #cve202647065 #cve202694301 https://cybersecurity-news.de/apache-mina-cve-2026-94301-kritische-luecke-2-0-2-1

    Post summary

    The tweet discloses that Apache MINA contains a critical vulnerability (CVE-2026-94301) affecting versions 2.0.x and 2.1.x despite an earlier fix.

    0000028
    13 followersView on X
  • SecAlerts@SecAlertsCo
    Disclosure

    ⚠️ Apache MINA: the CVE-2026-47065 fix (acceptMatchers filter bypass via java.lang.reflect.Proxy) was never backported to 2.0.30 or 2.1.14. CVE-2026-94301, CVSS 9.8. Still on those branches? You're exposed. #cybersecurity #ciso #vulnerabilities https://secalerts.co/vulnerability/CVE-2026-94301?utm_campaign=x https://t.co/UVgY9i3RqU

    Post summary

    The tweet discloses CVE-2026-94301 (CVSS 9.8) in Apache MINA, explaining that a prior fix (CVE-2026-47065) was not backported to versions 2.0.30 or 2.1.14, leaving users on those branches exposed. Technical details and a named patch (CVE-2026-47065) are referenced.

    0000068
    890 followersView on X
  • Severity Daily@severitydaily
    Patch

    Apache announced its 9.8 MINA deserialization fix as "Fully addressed" in three releases. It was committed to one branch. Two maintenance lines still listed as patched never received it. No exploitation reported. https://severitydaily.com/apache-mina-cve-2026-94301-resolveproxyclass-fix-2-2-branch-only/

    Post summary

    Apache released a fix for the MINA deserialization vulnerability (CVE‑2026‑94301), addressing it in three releases, while two maintenance branches remain unpatched and no exploitation has been reported.

    0000037
    25 followersView on X

Explore more

Back to dashboard