[NEW] [high] Apache Nifi: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in Apache Nifi to bypass security measures, manipulate data, trigger a denial-of-service condition, or possibly execute arbitrary code.
CSIRTS triage
- What
- Multiple vulnerabilities in Linux Kernel enabling information disclosure, data manipulation, and denial-of-service conditions.
- Who is affected
- Linux systems running vulnerable kernel versions.
- Urgency
- Patch promptly as kernel vulnerabilities affecting information disclosure and DoS impact system security and availability.
- Action
- Update Linux Kernel to a version addressing CVE-2026-64561 through CVE-2026-64565.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Linux Kernel
Get an email when a new Linux Kernel advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2639
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-623540.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-689790.52% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-689800.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-689810.52% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-62354 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-68979 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-68980 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-68981 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- highCVE-2026-68981: Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST A…nvd
- criticalCVE-2026-68980: Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated wit…nvd
- criticalCVE-2026-68979: Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does…nvd
- mediumCVE-2026-62354: Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through…nvd
More from CERT-Bund (BSI) Security Advisories
- medium[UPDATE] [mittel] Red Hat Enterprise Linux (libreswan): Mehrere Schwachstellen ermöglichen Denial of Service2026-09-08
- medium[UPDATE] [mittel] Red Hat Enterprise Linux (sg3_utils): Schwachstelle ermöglicht Ausführen von beliebigem Prog…2026-09-08
- medium[UPDATE] [mittel] Golang Go-Module (Net, Image, Crypto: Mehrere Schwachstellen2026-09-08
- medium[UPDATE] [mittel] gzip: Mehrere Schwachstellen2026-09-08
- high[UPDATE] [hoch] Golang Go: Mehrere Schwachstellen2026-09-08