How severe is CVE-2026-62764?

CVE-2026-62764 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2026-62764 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (39th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-62764?

CVE-2026-62764 affects Apache Accumulo. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-62764?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-62764 published?

CVE-2026-62764 was published on 2026-07-17 and last updated on 2026-08-11.

CVE-2026-62764

CVE-2026-62764 is a medium-severity vulnerability in Apache Accumulo with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-274.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v4: 5.7
EPSS exploit prediction: 0% (39th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-274
Affected product: Apache Accumulo
Published: 2026-07-17
Last modified: 2026-08-11

Description

Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo. An authenticated, but low-privileged user without system permissions may issue a remote command to gracefully shutdown system components (compaction-coordinator, compactor, gc, manager, monitor, tserver, or sserver), leading to a denial of service. This issue affects Apache Accumulo 2.1.4 and 2.1.5. Users are recommended to upgrade to version 2.1.6, which fixes the issue.

Frequently asked questions

What is CVE-2026-62764?: Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo. An authenticated, but low-privileged user without system permissions may issue a remote command to gracefully shutdown system components (compaction-coordinator, compactor, gc, manager, monitor, tserver, or sserver), leading to a denial of service. This issue affects Apache Accumulo 2.1.4 and 2.1.5. Users are recommended to upgrade to version 2.1.6, which fixes the issue.
How severe is CVE-2026-62764?: CVE-2026-62764 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2026-62764 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (39th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-62764?: CVE-2026-62764 affects Apache Accumulo. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-62764?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-62764 published?: CVE-2026-62764 was published on 2026-07-17 and last updated on 2026-08-11.

References

Affected products (1)

cpe:2.3:a:apache:accumulo:*:*:*:*:*:*:*:*

More vulnerabilities in Apache Accumulo

CVE-2023-34340 — Critical (CVSS 9.8): Improper Authentication vulnerability in Apache Software Foundation Apache Accumulo. This issue affects Apache…
CVE-2020-17533 — High (CVSS 8.1): Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy…

All CVEs affecting Apache Accumulo →

Other CWE-274 vulnerabilities

CVE-2025-20156 — Critical (CVSS 9.9): A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low…
CVE-2024-0105 — High (CVSS 8.9): NVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient…
CVE-2024-0106 — High (CVSS 8.7): NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit (DPU) contains a vulnerability where an attacker…
CVE-2023-35928 — High (CVSS 8.4): Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server…
CVE-2024-21648 — High (CVSS 8.0): XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The rollback…
CVE-2020-24676 — High (CVSS 7.8): In Symphony Plus Operations and Symphony Plus Historian, some services can be vulnerable to privilege escalation…

Browse all CWE-274 vulnerabilities →