CVE-2026-120209: Critical RCE in AJ-Report via JWT Token

CVE-2026-120209 affects AJ-Report up to version 1.7.1 and describes a critical unauthenticated remote code execution (RCE) vulnerability. The flaw lies in the Share-Token signature mechanism, which uses a hard-coded JWT secret, allowing attackers to generate valid tokens offline. By accessing the testTransform endpoint with a forged token, attackers can send scripts to GroovyClassLoader for unauthenticated remote code execution, completely compromising the security posture of the platform.

The assigned CVSS score is 9.8 (critical), indicating potentially devastating impact on confidentiality, integrity, and availability. The vulnerability was published by NVD on 2026-10-31 and is already subject to public signals: on 2026-11-06, exploit code availability was identified in public GitHub repositories claiming to contain proof-of-concept for RCE and privilege escalation. Confirmed market status makes the risk immediate and concrete for every organization running AJ-Report instances.

Organizations managing AJ-Report instances must immediately apply updates beyond version 1.7.1 once available from the vendor. In the meantime, it is critical to: audit system logs for access to share tokens and requests to testTransform; restrict access to the testTransform endpoint via perimeter firewall or WAF; proactively revoke all share tokens generated before patching; monitor code execution activity and Groovy class loading in underlying Java applications. The vulnerability is critical and remotely exploitable without valid credentials, making remediation an immediate priority.