Live › vulnerability › CVE-2026-78674
Go to dashboardThe BPMN System REST APIs do not validate input parameters well enough. A logged-in user can send crafted requests that run arbitrary commands on the server with the privileges of the product's runtime account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 20:35 UTC. All times on this page are UTC.
Only systems running the unidentified product that exposes the BPMN System REST APIs are affected, and an attacker needs a valid login. If you run a BPMN or workflow product, check which vendor ships a component named 'BPMN System' and whether its REST API is reachable by users you do not fully trust. Deployments where no untrusted users can log in are at lower risk, but the commands run as the product's service account.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server.
An authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product's runtime account. The scope of potential damage is contingent upon the permissions assigned to this account.
This page as .md · .json · in your agent: get_signal("CVE-2026-78674")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.