High severity8.0NVD Advisory· Published Nov 16, 2020· Updated Jun 17, 2026

CVE-2020-26217

Description

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
com.thoughtworks.xstream:xstreamMaven	< 1.4.14-java7	1.4.14-java7

Affected products

Xstream/Xstream2 versions
cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*range: <1.4.14
- (no CPE)range: < 1.4.14
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
NetApp/Snapmanager2 versions
cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:sap:*:*+ 1 more
- cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:sap:*:*
- cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:*
Apache/Activemq2 versions
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*range: <5.15.14
- cpe:2.3:a:apache:activemq:5.16.0:*:*:*:*:*:*:*
Oracle Corporation/Banking Cash Management3 versions
cpe:2.3:a:oracle:banking_cash_management:14.2:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:banking_cash_management:14.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_cash_management:14.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_cash_management:14.5:*:*:*:*:*:*:*
Oracle Corporation/Banking Corporate Lending Process Management3 versions
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5:*:*:*:*:*:*:*
Oracle Corporation/Banking Credit Facilities Process Management3 versions
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5:*:*:*:*:*:*:*
Oracle Corporation/Banking Platform3 versions
cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*
Oracle Corporation/Banking Supply Chain Finance3 versions
cpe:2.3:a:oracle:banking_supply_chain_finance:14.2:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:banking_supply_chain_finance:14.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_supply_chain_finance:14.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_supply_chain_finance:14.5:*:*:*:*:*:*:*
Oracle Corporation/Banking Trade Finance Process Management3 versions
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5:*:*:*:*:*:*:*
Oracle Corporation/Banking Virtual Account Management3 versions
cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:*
Oracle Corporation/Business Activity Monitoring3 versions
cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Policy Management
cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*
Oracle Corporation/Endeca Information Discovery Studio
cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0.0:*:*:*:*:*:*:*
Oracle Corporation/Retail Xstore Point Of Service4 versions
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*
ghsa-coords35 versions
pkg:maven/com.thoughtworks.xstream/xstream pkg:rpm/suse/mgr-libmod&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/prometheus-exporters-formula&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/susemanager-schema&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/spacewalk-backend&distro=SUSE%20Manager%20Proxy%20Module%204.1 pkg:rpm/opensuse/xstream&distro=openSUSE%20Tumbleweed pkg:rpm/suse/spacewalk-utils&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/xpp3&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/xstream&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP2 pkg:bitnami/activemq pkg:rpm/suse/mgr-osad&distro=SUSE%20Manager%20Proxy%20Module%204.1 pkg:rpm/suse/rhnlib&distro=SUSE%20Manager%20Proxy%20Module%204.1 pkg:rpm/suse/spacewalk-client-tools&distro=SUSE%20Manager%20Proxy%20Module%204.1 pkg:rpm/suse/spacewalk-proxy&distro=SUSE%20Manager%20Proxy%20Module%204.1 pkg:rpm/suse/spacewalk-proxy-installer&distro=SUSE%20Manager%20Proxy%20Module%204.1 pkg:rpm/suse/spacewalk-web&distro=SUSE%20Manager%20Proxy%20Module%204.1 pkg:rpm/suse/cobbler&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/grafana-formula&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/mgr-osad&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/prometheus-formula&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/py26-compat-salt&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/rhnlib&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/smdba&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/spacewalk-client-tools&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/spacewalk-config&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/spacewalk-java&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/spacewalk-web&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/subscription-matcher&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/susemanager&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/susemanager-doc-indexes&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/susemanager-docs_en&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/susemanager-sls&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/xstream&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/spacewalk-backend&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/opensuse/xstream&distro=openSUSE%20Leap%2015.2
< 1.4.14-java7+ 34 more
- (no CPE)range: < 1.4.14-java7
- (no CPE)range: < 4.1.7-3.16.2
- (no CPE)range: < 0.9.0-3.19.2
- (no CPE)range: < 4.1.19-3.24.4
- (no CPE)range: < 4.1.21-4.22.7
- (no CPE)range: < 1.4.18-1.1
- (no CPE)range: < 4.1.14-3.12.2
- (no CPE)range: < 1.1.4c-11.2.2
- (no CPE)range: < 1.4.15-3.3.2
- (no CPE)range: < 5.15.14
- (no CPE)range: < 4.1.5-2.9.4
- (no CPE)range: < 4.1.3-4.3.2
- (no CPE)range: < 4.1.9-4.12.4
- (no CPE)range: < 4.1.4-3.9.4
- (no CPE)range: < 4.1.6-3.3.2
- (no CPE)range: < 4.1.23-3.18.6
- (no CPE)range: < 3.0.0+git20190806.32c4bae0-5.6.4
- (no CPE)range: < 0.4.0-3.6.2
- (no CPE)range: < 4.1.5-2.9.4
- (no CPE)range: < 0.3.1-3.6.2
- (no CPE)range: < 2016.11.10-6.11.2
- (no CPE)range: < 4.1.3-4.3.2
- (no CPE)range: < 1.7.8-0.3.6.2
- (no CPE)range: < 4.1.9-4.12.4
- (no CPE)range: < 4.1.5-3.3.2
- (no CPE)range: < 4.1.30-3.31.7
- (no CPE)range: < 4.1.23-3.18.6
- (no CPE)range: < 0.26-3.6.2
- (no CPE)range: < 4.1.24-3.20.2
- (no CPE)range: < 4.1-11.28.4
- (no CPE)range: < 4.1-11.28.2
- (no CPE)range: < 4.1.21-3.26.2
- (no CPE)range: < 1.4.15-3.5.2
- (no CPE)range: < 4.1.21-4.22.7
- (no CPE)range: < 1.4.15-lp152.2.3.1

Patches

Vulnerability mechanics

References

github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1anvdPatchThird Party AdvisoryWEB
www.oracle.com//security-alerts/cpujul2021.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuApr2021.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuoct2021.htmlnvdPatchThird Party AdvisoryWEB
x-stream.github.io/CVE-2020-26217.htmlnvdExploitMitigationVendor AdvisoryWEB
github.com/advisories/GHSA-mw36-7c6c-q4q2ghsaADVISORY
github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2nvdMitigationThird Party AdvisoryWEB
lists.debian.org/debian-lts-announce/2020/12/msg00001.htmlnvdMailing ListThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2020-26217ghsaADVISORY
security.netapp.com/advisory/ntap-20210409-0004/nvdThird Party Advisory
www.debian.org/security/2020/dsa-4811nvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuapr2022.htmlnvdNot ApplicableThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujan2022.htmlnvdNot ApplicableThird Party AdvisoryWEB
lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e%40%3Cissues.activemq.apache.org%3EnvdIssue TrackingMailing List
lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e@%3Cissues.activemq.apache.org%3EghsaWEB
lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9%40%3Ccommits.camel.apache.org%3EnvdIssue TrackingMailing List
lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9@%3Ccommits.camel.apache.org%3EghsaWEB
lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c%40%3Cissues.activemq.apache.org%3EnvdIssue TrackingMailing List
lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c@%3Cissues.activemq.apache.org%3EghsaWEB
lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3%40%3Cissues.activemq.apache.org%3EnvdIssue TrackingMailing List
lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3@%3Cissues.activemq.apache.org%3EghsaWEB
security.netapp.com/advisory/ntap-20210409-0004ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.520
epss	0.068
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000