CVE-2026-6009: Jaspersoft Reports Library RCE Vulnerability

CVE-2026-6009 Overview

CVE-2026-6009 is a Java deserialization vulnerability in the Jaspersoft Reports Library that enables Remote Code Execution (RCE). The flaw allows an authenticated attacker with low privileges to execute arbitrary code on systems running the affected library. The vulnerability is classified under [CWE-502: Deserialization of Untrusted Data] and carries a CVSS 4.0 base score of 8.7. The issue is exploitable over the network without user interaction, which expands the attack surface for any application embedding the Jaspersoft Reports Library.

Critical Impact

Successful exploitation grants attackers the ability to execute arbitrary code with the privileges of the Jaspersoft Reports Library process, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

• Jaspersoft Reports Library (versions specified in the vendor advisory)
• Applications embedding the vulnerable Jaspersoft Reports Library
• Jaspersoft deployments that process untrusted serialized Java objects

Discovery Timeline

• 2026-05-19 - CVE-2026-6009 published to the National Vulnerability Database (NVD)
• 2026-05-19 - Jaspersoft publishes security advisory for CVE-2026-6009
• 2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-6009

Vulnerability Analysis

The vulnerability resides in how the Jaspersoft Reports Library deserializes Java objects from untrusted input. Java deserialization flaws occur when an application reconstructs serialized objects without validating the object types or content. Attackers craft malicious serialized payloads that invoke gadget chains during deserialization. When the library processes these payloads, the embedded gadget chain triggers arbitrary method calls, ending in code execution within the Java Virtual Machine (JVM).

Because the Jaspersoft Reports Library is commonly embedded in enterprise reporting and business intelligence applications, exploitation can pivot from a reporting subsystem into core application infrastructure. The attack requires only low-privilege authentication and no user interaction.

Root Cause

The root cause is unsafe handling of serialized Java objects passed to ObjectInputStream or equivalent deserialization routines within the Jaspersoft Reports Library. The library does not enforce a strict allow-list of classes permitted during deserialization. Any class available on the classpath, including known gadget classes from libraries such as Apache Commons Collections, can be instantiated and invoked through the deserialization process.

Attack Vector

An authenticated attacker submits a crafted serialized payload to an application endpoint that forwards data to the Jaspersoft Reports Library. Typical entry points include report parameters, embedded data sources, or APIs that accept binary report definitions. The library deserializes the payload, which executes the attacker-controlled gadget chain. The attacker gains code execution as the user account running the JVM hosting the reports library.

No proof-of-concept exploit is publicly available at the time of publication. Refer to the Jaspersoft Security Advisory CVE-2026-6009 for vendor-supplied technical details.

Detection Methods for CVE-2026-6009

Indicators of Compromise

• Unexpected child processes spawned by the Java process hosting the Jaspersoft Reports Library, such as sh, cmd.exe, powershell.exe, or scripting interpreters
• Outbound network connections from the reporting service to unknown or unauthorized hosts
• Java stack traces in application logs referencing ObjectInputStream.readObject followed by gadget classes such as InvokerTransformer or TemplatesImpl
• New or modified files in temporary directories used by the JVM

Detection Strategies

• Inspect HTTP and application-layer traffic for serialized Java magic bytes (AC ED 00 05) or Base64-encoded equivalents (rO0AB) in report parameters and request bodies
• Monitor JVM processes for anomalous behavior, including spawning of operating system shells from a reporting service
• Correlate authentication events with subsequent privileged process creation on hosts running Jaspersoft components

Monitoring Recommendations

• Enable verbose logging on the Jaspersoft Reports Library to capture deserialization activity and parameter inputs
• Forward application, JVM, and host telemetry to a centralized analytics platform for cross-source correlation
• Set alerts on web application firewall (WAF) signatures targeting Java deserialization payloads

How to Mitigate CVE-2026-6009

Immediate Actions Required

• Apply the security update referenced in the Jaspersoft Security Advisory CVE-2026-6009 on all affected systems
• Inventory all applications that embed the Jaspersoft Reports Library and confirm the library version in use
• Restrict network access to reporting endpoints so that only authorized internal services can submit report requests
• Review and rotate credentials that could have been exposed to the vulnerable service

Patch Information

Jaspersoft has published a security advisory addressing CVE-2026-6009. Administrators should consult the Jaspersoft Security Advisory CVE-2026-6009 for the fixed library versions and upgrade instructions. Embedded deployments require rebuilding host applications against the patched library.

Workarounds

• Place the reporting service behind authentication and authorization controls that limit access to trusted users only
• Deploy a Java deserialization filter using jdk.serialFilter to allow-list only the classes required by the application
• Block requests containing serialized Java object signatures at the WAF or reverse proxy layer until patching is complete
• Run the Jaspersoft Reports Library process with the least privilege necessary to limit blast radius from any successful exploitation

# Configuration example: restrict Java deserialization with a global serial filter
# Add to the JVM startup parameters of the application embedding Jaspersoft
-Djdk.serialFilter="java.base/*;java.util.*;!*"

# Or configure in conf/security/java.security
jdk.serialFilter=java.base/*;java.util.*;!*