CVE-2026-28672: apache ranger

CVSS 9.8 (critical) · published 2026-08-10

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8.

Affected products (NVD): apache ranger

Weakness: CWE-77

Source: NVD CVE-2026-28672

References

• https://lists.apache.org/thread/99ysjqcmz950o3jgm6pqx1wb696onzq7
• http://www.openwall.com/lists/oss-security/2026/08/09/2

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.