Cyber Posture

CVE-2026-22601

HighRCE

Published: 10 January 2026

Published
10 January 2026
Modified
14 January 2026
KEV Added
Patch
CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0008 24.1th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-22601 is a high-severity Command Injection (CWE-77) vulnerability in Openproject Openproject. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.
Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

Command injection in web app directly enables RCE (T1190) via Unix shell (T1059.004) for authenticated admin.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

OpenProject is an open-source, web-based project management software. For OpenProject version 16.6.1 and below, a registered administrator can execute arbitrary command by configuring sendmail binary path and sending a test email. This issue has been patched in version 16.6.2.

Deeper analysisAI

CVE-2026-22601 is a command injection vulnerability (CWE-77) in OpenProject, an open-source web-based project management software. It affects versions 16.6.1 and below, where a registered administrator can execute arbitrary commands by configuring the sendmail binary path and sending a test email.

A registered administrator (PR:H) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no additional user interaction (UI:N). Exploitation allows arbitrary command execution on the server, resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), with an unchanged scope (S:U) and a CVSS v3.1 base score of 7.2.

The issue has been patched in OpenProject version 16.6.2. Mitigation details are available in the release notes at https://github.com/opf/openproject/releases/tag/v16.6.2 and the security advisory at https://github.com/opf/openproject/security/advisories/GHSA-9vrv-7h26-c7jc.

Details

CWE(s)

Affected Products

openproject
openproject
≤ 16.6.2

CVEs Like This One

CVE-2026-24685Same product: Openproject Openproject
CVE-2026-25763Same product: Openproject Openproject
CVE-2026-32698Same product: Openproject Openproject
CVE-2026-34717Same product: Openproject Openproject
CVE-2026-30239Same product: Openproject Openproject
CVE-2026-24775Same product: Openproject Openproject
CVE-2026-24772Same product: Openproject Openproject
CVE-2026-32703Same product: Openproject Openproject
CVE-2026-23625Same product: Openproject Openproject
CVE-2026-22600Same product: Openproject Openproject

References