Back to CVE records
High 7.3HealthcarePublished Aug 20, 2019
CVE-2019-10086In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Ja…
Updated under an hour ago ()
Does this affect you?
It affects Apache Commons Beanutils and 58 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 28.38%, higher than 98% of scored CVEs. That is high: schedule it on your emergency patch path.
Do this next
Start free and add your stack
Free account, 1 product
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
- CVSS
- 7.3 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 28.38% (percentile 98)
- Assigned by
- apache
- NVD analysis
- Modified
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Apache Apache Commons Beanutils apache:commons_beanutils (from the name) | Apache Commons Beanutils 1.0 to 1.9.3 | CNA record |
apache commons_beanutils apache:commons_beanutils | from 1.0 through 1.9.3 | NVD |
apache nifi apache:nifi | 1.14.0; 1.15.0 | NVD |
debian debian_linux debian:debian_linux | 8.0 | NVD |
opensuse leap opensuse:leap | 15.0; 15.1 | NVD |
fedoraproject fedora fedoraproject:fedora | 30; 31 | NVD |
redhat enterprise_linux_desktop redhat:enterprise_linux_desktop | 7.0 | NVD |
redhat enterprise_linux_eus redhat:enterprise_linux_eus | 7.7 | NVD |
redhat enterprise_linux_server redhat:enterprise_linux_server | 7.0 | NVD |
redhat enterprise_linux_server_aus redhat:enterprise_linux_server_aus | 7.7 | NVD |
redhat enterprise_linux_server_tus redhat:enterprise_linux_server_tus | 7.7 | NVD |
redhat enterprise_linux_workstation redhat:enterprise_linux_workstation | 7.0 | NVD |
redhat jboss_enterprise_application_platform redhat:jboss_enterprise_application_platform | 7.2.0 | NVD |
oracle agile_product_lifecycle_management oracle:agile_product_lifecycle_management | 9.3.3; 9.3.5; 9.3.6 | NVD |
oracle agile_product_lifecycle_management_integration_pack oracle:agile_product_lifecycle_management_integration_pack | 3.5; 3.5; 3.6; 3.6 | NVD |
oracle application_testing_suite oracle:application_testing_suite | 13.3.0.1 | NVD |
oracle banking_platform oracle:banking_platform | 2.4.0; 2.7.1; 2.9.0 | NVD |
oracle blockchain_platform oracle:blockchain_platform | before 21.1.2 | NVD |
oracle communications_billing_and_revenue_management oracle:communications_billing_and_revenue_management | 7.5; 12.0.0.3.0 | NVD |
oracle communications_billing_and_revenue_management_elastic_charging_engine oracle:communications_billing_and_revenue_management_elastic_charging_engine | 11.3.0.9; 12.0.0.3 | NVD |
oracle communications_cloud_native_core_console oracle:communications_cloud_native_core_console | 1.4.0 | NVD |
oracle communications_cloud_native_core_policy oracle:communications_cloud_native_core_policy | 1.9.0 | NVD |
oracle communications_cloud_native_core_unified_data_repository oracle:communications_cloud_native_core_unified_data_repository | 1.6.0 | NVD |
oracle communications_convergence oracle:communications_convergence | 3.0.2.2.0 | NVD |
oracle communications_design_studio oracle:communications_design_studio | 7.3.4; 7.3.5; 7.4.0 | NVD |
oracle communications_evolved_communications_application_server oracle:communications_evolved_communications_application_server | 7.1 | NVD |
oracle communications_metasolv_solution oracle:communications_metasolv_solution | 6.3.0; 6.3.1 | NVD |
oracle communications_network_integrity oracle:communications_network_integrity | 7.3.6 | NVD |
oracle communications_performance_intelligence_center oracle:communications_performance_intelligence_center | 10.4.0.3 | NVD |
oracle communications_pricing_design_center oracle:communications_pricing_design_center | 12.0.0.3.0 | NVD |
oracle communications_unified_inventory_management oracle:communications_unified_inventory_management | 7.3.4; 7.3.5; 7.4.0; 7.4.1 | NVD |
oracle customer_management_and_segmentation_foundation oracle:customer_management_and_segmentation_foundation | 18.0 | NVD |
oracle enterprise_manager_for_virtualization oracle:enterprise_manager_for_virtualization | 13.4.0.0 | NVD |
oracle financial_services_revenue_management_and_billing_analytics oracle:financial_services_revenue_management_and_billing_analytics | 2.7; 2.8 | NVD |
oracle flexcube_private_banking oracle:flexcube_private_banking | 12.0.0; 12.1.0 | NVD |
oracle fusion_middleware oracle:fusion_middleware | 11.1.1.9; 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle healthcare_foundation oracle:healthcare_foundation | 7.1.5; 7.2.2; 7.3.0; 7.3.1; 8.0.1 | NVD |
oracle hospitality_opera_5 oracle:hospitality_opera_5 | 5.5; 5.6 | NVD |
oracle hospitality_reporting_and_analytics oracle:hospitality_reporting_and_analytics | 9.1.0 | NVD |
oracle insurance_data_gateway oracle:insurance_data_gateway | 1.0.2.3 | NVD |
oracle jd_edwards_enterpriseone_orchestrator oracle:jd_edwards_enterpriseone_orchestrator | before 9.2.5.3; 9.2.5.3 | NVD |
oracle jd_edwards_enterpriseone_tools oracle:jd_edwards_enterpriseone_tools | before 9.2.5.3; 9.2.5.3 | NVD |
oracle peoplesoft_enterprise_peopletools oracle:peoplesoft_enterprise_peopletools | 8.56; 8.57 | NVD |
oracle peoplesoft_enterprise_pt_peopletools oracle:peoplesoft_enterprise_pt_peopletools | 8.56; 8.57; 8.58 | NVD |
oracle primavera_gateway oracle:primavera_gateway | from 16.2.0 through 16.2.11; from 17.12.0 through 17.12.6 | NVD |
oracle real-time_decisions_solutions oracle:real-time_decisions_solutions | 3.2.0.0 | NVD |
oracle retail_advanced_inventory_planning oracle:retail_advanced_inventory_planning | 14.1 | NVD |
oracle retail_back_office oracle:retail_back_office | 14.1 | NVD |
oracle retail_central_office oracle:retail_central_office | 14.1 | NVD |
oracle retail_invoice_matching oracle:retail_invoice_matching | 16.0.3 | NVD |
oracle retail_merchandising_system oracle:retail_merchandising_system | 5.0.3.1 | NVD |
oracle retail_point-of-service oracle:retail_point-of-service | 14.1 | NVD |
oracle retail_predictive_application_server oracle:retail_predictive_application_server | 16.0 | NVD |
oracle retail_price_management oracle:retail_price_management | 14.0; 14.0.1; 15.0; 16.0 | NVD |
oracle retail_returns_management oracle:retail_returns_management | 14.1 | NVD |
oracle retail_xstore_point_of_service oracle:retail_xstore_point_of_service | 7.1; 15.0; 16.0; 17.0; 18.0 | NVD |
oracle service_bus oracle:service_bus | 11.1.1.9.0; 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle solaris_cluster oracle:solaris_cluster | 4.4 | NVD |
oracle time_and_labor oracle:time_and_labor | from 12.2.6 through 12.2.11 | NVD |
oracle utilities_framework oracle:utilities_framework | from 4.3.0.1.0 through 4.3.0.6.0; 4.2.0.2.0; 4.2.0.3.0; 4.4.0.0.0; 4.4.0.2.0; 4.4.0.3.0 | NVD |
References
- http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC628798F-315D-4428-8CB1-4ED1ECC958E4%40apache.org%3emailing-list, x-refsource-mlist
- https://lists.debian.org/debian-lts-announce/2019/08/msg00030.htmlmailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/3d1ed1a1596c08c4d5fea97b36c651ce167b773f1afc75251ce7a125%40%3Ccommits.tinkerpop.apache.org%3Emailing-list, x-refsource-mlist
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00007.htmlvendor-advisory, x-refsource-suse, mailing-list, third-party-advisory
- https://lists.apache.org/thread.html/956995acee0d8bc046f1df0a55b7fbeb65dd2f82864e5de1078bacb0%40%3Cissues.commons.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5%40%3Cissues.commons.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/02094ad226dbc17a2368beaf27e61d8b1432f5baf77d0ca995bb78bc%40%3Cissues.commons.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/d6ca9439c53374b597f33b7ec180001625597db48ea30356af01145f%40%3Cdev.shiro.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/2fd61dc89df9aeab738d2b49f48d42c76f7d53b980ba04e1d48bce48%40%3Cdev.shiro.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/c94bc9649d5109a663b2129371dc45753fbdeacd340105548bbe93c3%40%3Cdev.shiro.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/5261066cd7adee081ee05c8bf0e96cf0b2eeaced391e19117ae4daa6%40%3Cdev.shiro.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/a684107d3a78e431cf0fbb90629e8559a36ff8fe94c3a76e620b39fa%40%3Cdev.shiro.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4APPGLBWMFAS4WHNLR4LIJ65DJGPV7TF/vendor-advisory, x-refsource-fedora
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIUYSL2RSIWZVNSUIXJTIFPIPIF6OAIO/vendor-advisory, x-refsource-fedora
- https://access.redhat.com/errata/RHSA-2019:4317vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/errata/RHSA-2020:0057vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/errata/RHSA-2020:0194vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/errata/RHSA-2020:0806vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/errata/RHSA-2020:0811vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/errata/RHSA-2020:0804vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/errata/RHSA-2020:0805vendor-advisory, x-refsource-redhat, third-party-advisory
- https://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9%40%3Cdev.brooklyn.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r18d8b4f9263e5cad3bbaef0cdba0e2ccdf9201316ac4b85e23eb7ee4%40%3Cdev.atlas.apache.org%3E
- https://lists.apache.org/thread.html/r2d5f1d88c39bd615271abda63964a0bee9b2b57fef1f84cb4c43032e%40%3Cissues.nifi.apache.org%3E
- https://lists.apache.org/thread.html/r306c0322aa5c0da731e03f3ce9f07f4745c052c6b73f4e78faf232ca%40%3Cdev.atlas.apache.org%3E
- https://lists.apache.org/thread.html/r43de02fd4a4f52c4bdeff8c02f09625d83cd047498009c1cdab857db%40%3Cdev.rocketmq.apache.org%3E
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.