CVE-2025-59059
Published: 03 March 2026
Summary
CVE-2025-59059 is a critical-severity Code Injection (CWE-94) vulnerability in Apache Ranger. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates identification, reporting, and correction of flaws like the unauthenticated RCE in NashornScriptEngineCreator by applying the upgrade to Apache Ranger 2.8.0.
Monitors and controls communications at external and key internal boundaries to deny network access needed for remote exploitation of the vulnerable Apache Ranger server.
Conducts vulnerability scanning to identify the presence of CVE-2025-59059 in Apache Ranger components, enabling timely remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2025-59059 is an unauthenticated remote code execution vulnerability in a network-accessible Apache Ranger server component, directly mapping to exploitation of a public-facing application.
NVD Description
Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2.8.0, which fixes this issue.
Deeper analysisAI
CVE-2025-59059 is a remote code execution vulnerability in the NashornScriptEngineCreator component of Apache Ranger versions 2.7.0 and earlier. Published on March 3, 2026, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact exploitation across confidentiality, integrity, and availability.
An unauthenticated attacker with network access can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation allows arbitrary code execution on the affected Apache Ranger server, potentially leading to full system compromise.
Apache advisories recommend upgrading to Apache Ranger version 2.8.0, which addresses this issue. Relevant discussions are available in the Apache mailing list at https://lists.apache.org/thread/z47q86rho80390lf2qcmoc2josvs0gtv and the oss-security list at http://www.openwall.com/lists/oss-security/2026/03/02/5.
Details
- CWE(s)