Key points
- Camunda 7.24.0 through 7.24.13 and 7.23.0 through 7.23.16 are affected.
- The flaw allows bypassing the enableExpressionsInAdhocQueries security restriction.
- Attackers can execute arbitrary Java reflection and operating system commands.
Camunda 7 versions prior to 7.24.14 and 7.23.17 contain a critical vulnerability. National Vulnerability Database records identify CVE-2026-109432 with a CVSS score of 9.3. The issue affects the expression handling within the ad-hoc query validator. Authenticated attackers can exploit this to run commands on the underlying server.
In plain English
The security check for ad-hoc queries fails to inspect certain sub-query maps. Specifically, the AdhocQueryValidator.validate function ignores expression data inside the orQueries field of TaskQueryDto. This oversight lets users bypass the enableExpressionsInAdhocQueries setting. They can insert malicious JUEL expressions, such as dueAfterExpression, into these entries.
The background
Once the malicious expression is accepted, the system performs arbitrary Java reflection. This allows the attacker to invoke java.lang.Runtime.exec. The resulting command runs with the privileges of the engine service user. The flaw combines CWE-917 and CWE-78 weaknesses. It turns a configuration restriction into a bypass mechanism.
What changes now
Teams must verify which Camunda 7 versions run in their environments. Any instance below 7.24.14 or 7.23.17 is exposed to remote command execution. The vulnerability requires authentication but grants significant control over the host system. Patching remains the primary mitigation strategy against this high-severity threat.
Who needs to act first
Focus on systems exposed to the internet or broad internal networks first. Identify all Camunda 7 instances before applying updates. Test patches in a non-production environment to ensure stability. Create full system backups before deploying fixes. Restrict network access to vulnerable services if immediate patching is not possible. Monitor logs for unusual query patterns during the transition period.
What to do and how to stay safe: Camunda
- Inventory all Camunda 7 deployments to identify affected version numbers immediately.
- Apply available vendor updates to reach version 7.24.14 or 7.23.17 as soon as possible.
- Review access controls to limit authenticated user capabilities on vulnerable systems.
- Monitor server logs for unexpected process executions or reflection-based activity.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Camunda 7 versions are vulnerable to CVE-2026-109432?
Versions 7.24.0 through 7.24.13 and 7.23.0 through 7.23.16 are affected by this flaw.
Does an attacker need to be authenticated to exploit this?
Yes, the vulnerability requires the attacker to have valid authentication credentials to submit malicious queries.
What is the technical cause of this command execution?
The validator fails to check sub-query expression maps, allowing bypass of expression restrictions via JUEL injection.
