CVE-2026-6009

Jaspersoft Library Deserialisation Vulnerability

State: Published
Severity: 8.7 High
Published: May 19, 2026
Updated: May 20, 2026
Reserved: Apr 9, 2026

Description

Java Deserialisation Vulnerability in Jaspersoft Reports Library leads to Remote Code Execution (RCE), potentially allowing code execution on the affected system

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	Jaspersoft

Weaknesses

CWE-502 Deserialization of untrusted data

Affected Products

Product	Versions
JasperReports Library Community EditionJaspersoft	7.0.6 and earlierAffected
Jaspersoft Studio Community EditionJaspersoft	7.0.6 and earlierAffected
JasperReports ServerJaspersoft	10.0.0 and earlierAffected
JasperReports Library ProfessionalJaspersoft	10.0.0 and earlierAffected
Jaspersoft Studio ProfessionalJaspersoft	10.0.0 and earlierAffected
JasperReports IO ProfessionalJaspersoft	10.0.0 and earlierAffected
JasperReports IO At-ScaleJaspersoft	10.0.0 and earlierAffected
JasperReports Web StudioJaspersoft	10.0.1 and earlierAffected

References

https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-may-19-2026-jaspersoft-library-cve-2026-6009-r11/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.