CVE-2014-0114
USN-8322-1 fixed a vulnerability in Apache Commons BeanUtils. It was discovered that for Ubuntu 18.04 LTS, during the update preparation phase, a previous fix for CVE-2014-0114 and CVE-2019-10086 was incorrectly dropped. This update reintroduces the fix for CVE-2014-0114 and CVE-2019-10086. We apologize for the inconvenience. Original advisory details: It was discovered that Apache Commons BeanUtils incorrectly allowed access to the declaredClass property of Java enum objects when handling externally supplied property paths. An attacker could possibly use this issue to execute arbitrary code.
CSIRTS triage
- What
- An attacker could possibly use this issue to execute arbitrary code due to incorrect handling of property paths.
- Who is affected
- Users of Apache Commons BeanUtils on Ubuntu 18.04 LTS are affected by this regression.
- Urgency
- The urgency is unclear as the severity is marked as unknown, but it is important to address the regression.
- Action
- Reapply the fix for CVE-2014-0114 and CVE-2019-10086.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2014-0114
Get an email if CVE-2014-0114 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Exploitation likely imminentEPSS puts this in the most-targeted tier (96.1% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 100% of all EPSS-scored CVEs.
Advisory coverage (1)
- unknownUSN-8322-2: Apache Commons BeanUtils regressionubuntu · 2026-07-23
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2014-0114)