Intel

CVE-2026-40008

Verwendung von extern gesteuerten Eingaben zur Auswahl von Klassen oder Code ('Unsichere Reflexion') Schwachstelle in Apache IoTDB.

criticalEPSS 0.6%

Description

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

Source: cvelistv5NVD (NIST)

Metrics

XIEM Effective CVSS
9.8
Source: nvd-v3
EPSS percentile
47.0 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
critical
Priority score
88.49
Exploit maturity
no public PoC known
CVSS v3
9.8
EPSS score
0.6 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-07-10 07:13 UTC
CWE
CWE-470

Weakness classes (CWE)

  • CWE-470Base

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

    The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

    cwe.mitre.org →

References & sources

Linked advisories