How severe is CVE-2020-11986?

CVE-2020-11986 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2020-11986 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 10% (95th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-11986?

CVE-2020-11986 affects Apache Netbeans. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-11986?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2020-11986 published?

CVE-2020-11986 was published on 2020-09-09 and last updated on 2026-06-17.

CVE-2020-11986

CVE-2020-11986 is a critical-severity vulnerability in Apache Netbeans with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 7.5
EPSS exploit prediction: 10% (95th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Apache Netbeans
Published: 2020-09-09
Last modified: 2026-06-17

Description

To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.

Frequently asked questions

What is CVE-2020-11986?: To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
How severe is CVE-2020-11986?: CVE-2020-11986 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2020-11986 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 10% (95th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-11986?: CVE-2020-11986 affects Apache Netbeans. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-11986?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2020-11986 published?: CVE-2020-11986 was published on 2020-09-09 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:apache:netbeans:*:*:*:*:*:*:*:*

More vulnerabilities in Apache Netbeans

CVE-2018-17191 — Critical (CVSS 9.8): Apache NetBeans (incubating) 9.0 NetBeans Proxy Auto-Configuration (PAC) interpretation is vulnerable for remote…
CVE-2019-17560 — Critical (CVSS 9.1): The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads.…
CVE-2019-17561 — High (CVSS 7.5): The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the…

All CVEs affecting Apache Netbeans →