USN-8322-2: Apache Commons BeanUtils regression
USN-8322-1 fixed a vulnerability in Apache Commons BeanUtils. It was discovered that for Ubuntu 18.04 LTS, during the update preparation phase, a previous fix for CVE-2014-0114 and CVE-2019-10086 was incorrectly dropped. This update reintroduces the fix for CVE-2014-0114 and CVE-2019-10086. We apologize for the inconvenience. Original advisory details: It was discovered that Apache Commons BeanUtils incorrectly allowed access to the declaredClass property of Java enum objects when handling externally supplied property paths. An attacker could possibly use this issue to execute arbitrary code.
CSIRTS triage
- What
- An attacker could possibly use this issue to execute arbitrary code due to incorrect handling of property paths.
- Who is affected
- Users of Apache Commons BeanUtils on Ubuntu 18.04 LTS are affected by this regression.
- Urgency
- The urgency is unclear as the severity is marked as unknown, but it is important to address the regression.
- Action
- Reapply the fix for CVE-2014-0114 and CVE-2019-10086.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Commons BeanUtils
Get an email when a new Commons BeanUtils advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://ubuntu.com/security/notices/USN-8322-2
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation likely imminentCVE-2014-0114EPSS puts this in the most-targeted tier (96.1% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 100% of all scored CVEs.
- Elevated exploitation riskCVE-2019-1008629.8% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 98% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2014-0114 | coverage & exploitation status | NVD · CVE.org |
| CVE-2019-10086 | coverage & exploitation status | NVD · CVE.org |
More from Ubuntu Security Notices
- highUSN-8620-4: Linux kernel (Intel IoTG) vulnerabilities2026-07-31
- highUSN-8620-3: Linux kernel (Intel IoTG) vulnerabilities2026-07-31
- unknownUSN-8625-1: OpenSSL vulnerability2026-07-30
- unknownUSN-8624-1: Sinatra vulnerability2026-07-29
- unknownUSN-8623-1: Linux kernel (NVIDIA) vulnerabilities2026-07-29