AUGUST 4, 2026
Live Feed
Return to register
Case File

CVE-2018-8016

CRITICAL · CVSS 9.8 EPSS 2.27%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2018-06-28 · Last synced 2026-08-04

Field Assessment

AI analysis pending.

CVE
CVE-2018-8016
Severity
CRITICAL
CVSS
9.8
EPSS
2.27%
Apache Java

Original Filing — NVD Description

The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request. This issue is a regression of CVE-2015-0225. The regression was introduced in https://issues.apache.org/jira/browse/CASSANDRA-12109. The fix for the regression is implemented in https://issues.apache.org/jira/browse/CASSANDRA-14173. This fix is contained in the 3.11.2 release of Apache Cassandra.