CVE-2026-67961: O2OA Sandbox Escape RCE Vulnerability

CVE-2026-67961 Overview

CVE-2026-67961 is a code injection vulnerability in O2OA v10.0.2, an open-source collaborative office automation platform. The flaw resides in the sandbox mechanism protecting the Invoke script execution feature. A local, authenticated attacker can bypass the sandbox restrictions to execute arbitrary code on the host system. The vulnerability maps to CWE-94: Improper Control of Generation of Code.

Critical Impact
Successful exploitation grants attackers arbitrary code execution with the privileges of the O2OA process, compromising confidentiality, integrity, and availability of the host.

Affected Products

O2OA version 10.0.2
O2OA x_program_center Invoke script execution component
Deployments exposing the Invoke JAX-RS endpoint to authenticated users

Discovery Timeline

2026-08-17 - CVE-2026-67961 published to the National Vulnerability Database (NVD)
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-67961

Vulnerability Analysis

O2OA exposes an Invoke feature that allows users to execute server-side scripts through the x_program_center JAX-RS endpoint. Scripts run within a sandbox intended to restrict access to sensitive Java classes, system resources, and reflective operations. The sandbox in version 10.0.2 fails to fully constrain the script execution environment. An attacker with local access and low privileges can craft an Invoke script that escapes the sandbox and reaches restricted Java APIs.

Once the sandbox is bypassed, the attacker gains the ability to execute arbitrary code in the context of the O2OA server process. This includes reading and writing arbitrary files, launching operating system commands, and pivoting to other services accessible from the host. The classification as CWE-94 reflects the underlying failure to safely constrain generated or interpreted code.

Root Cause

The root cause is an incomplete sandbox implementation in the Invoke script executor. Restricted class filtering, reflection controls, or class loader boundaries do not sufficiently block access to dangerous Java runtime primitives. This gap allows crafted scripts to obtain references to classes such as process launchers or file system APIs that the sandbox was intended to deny.

Attack Vector

Exploitation requires local access and authenticated, low-privileged access to the O2OA application. The attacker submits a malicious Invoke script through the exposed endpoint. The script exercises the sandbox weakness to reach privileged APIs and execute attacker-controlled logic. No user interaction is required beyond the attacker's own authenticated session.

Refer to the published O2OA Invoke Sandbox Bypass Vulnerability Analysis for the technical proof-of-concept details.

Detection Methods for CVE-2026-67961

Indicators of Compromise

Requests to the x_program_center/jaxrs/invoke/ endpoint containing script payloads that reference java.lang.Runtime, ProcessBuilder, java.lang.reflect, or class loader manipulation.
Unexpected child processes spawned by the O2OA Java process (for example, sh, bash, cmd.exe, or powershell.exe).
New or modified files under the O2OA installation directory not associated with a legitimate deployment.
Outbound network connections from the O2OA process to unknown hosts following Invoke API activity.

Detection Strategies

Enable verbose logging on the Invoke endpoint and alert on script submissions that contain reflection or process execution keywords.
Baseline the O2OA process tree and alert on any process spawned as a child of the Java runtime hosting O2OA.
Correlate authenticated Invoke API calls with subsequent file system or command execution events on the host.

Monitoring Recommendations

Forward O2OA application logs and host process telemetry into a centralized SIEM or data lake for correlation.
Monitor authentication logs for low-privileged accounts that suddenly begin using the Invoke feature.
Track integrity of scripts and configuration files within the x_program_center module for unauthorized modification.

How to Mitigate CVE-2026-67961

Immediate Actions Required

Restrict network and local access to the O2OA Invoke endpoint to trusted administrative users only.
Audit accounts with permission to submit Invoke scripts and remove access for users that do not require it.
Review historical logs for unauthorized use of the Invoke feature dating back to deployment of v10.0.2.

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry for CVE-2026-67961. Monitor the O2OA project repository for a security release addressing the sandbox bypass and upgrade as soon as a patched version becomes available.

Workarounds

Disable the Invoke script execution feature in x_program_center if it is not required for business operations.
Apply strict role-based access controls so only administrators can create or execute Invoke scripts.
Run the O2OA service under a dedicated, least-privileged operating system account to limit blast radius of code execution.
Place the O2OA management interfaces behind a VPN or bastion host to reduce local attacker exposure.

bash

# Configuration example: restrict Invoke endpoint via reverse proxy
location /x_program_center/jaxrs/invoke/ {
    allow 10.0.0.0/24;   # administrative subnet only
    deny  all;
    proxy_pass http://o2oa_backend;
}