Cyber Resilience

CVE-2026-22601

HighRCE

Published: 10 January 2026

Published
10 January 2026
Modified
14 January 2026
KEV Added
—
Patch
—
CVSS Score v4 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0032 24.1th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-22601 is a high-severity Command Injection (CWE-77) vulnerability in Openproject Openproject. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-22601 is a command injection vulnerability (CWE-77) in OpenProject, an open-source web-based project management software. It affects versions 16.6.1 and below, where a registered administrator can execute arbitrary commands by configuring the sendmail binary path and sending a test email.

A registered administrator (PR:H) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no additional user interaction (UI:N). Exploitation allows arbitrary command execution on the server, resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), with an unchanged scope (S:U) and a CVSS v3.1 base score of 7.2.

The issue has been patched in OpenProject version 16.6.2. Mitigation details are available in the release notes at https://github.com/opf/openproject/releases/tag/v16.6.2 and the security advisory at https://github.com/opf/openproject/security/advisories/GHSA-9vrv-7h26-c7jc.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

OpenProject is an open-source, web-based project management software. For OpenProject version 16.6.1 and below, a registered administrator can execute arbitrary command by configuring sendmail binary path and sending a test email. This issue has been patched in version 16.6.2.

CWE(s)
CWE-77

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

Command injection in web app directly enables RCE (T1190) via Unix shell (T1059.004) for authenticated admin.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-24685Same product: Openproject Openproject
CVE-2026-25763Same product: Openproject Openproject
CVE-2026-32698Same product: Openproject Openproject
CVE-2026-24775Same product: Openproject Openproject
CVE-2026-30239Same product: Openproject Openproject
CVE-2026-34717Same product: Openproject Openproject
CVE-2026-24772Same product: Openproject Openproject
CVE-2026-23625Same product: Openproject Openproject
CVE-2026-32703Same product: Openproject Openproject
CVE-2026-40896Same product: Openproject Openproject

Affected Assets

openproject
openproject
≤ 16.6.2

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation and sanitization of the sendmail binary path input to block command injection.

CM-6 Configuration Settings good match
prevent

Enforces secure, restricted configuration settings for external binaries such as sendmail to prevent arbitrary command execution.

CM-7 Least Functionality partial match
prevent

Limits system functionality by restricting which executables or paths administrators may configure for email delivery.

References