CVE-2026-82384: RCE in Apache Roller 6.1.5

CVE-2026-82384 is an unauthenticated deserialization vulnerability in the XML-RPC endpoint of Apache Roller 6.1.5. The endpoint accepts vendor extension types that are deserialized during request parsing, before authentication checks. Since the servlet is mapped unconditionally, the vulnerability is exploitable even when XML-RPC is globally disabled. This allows arbitrary remote code execution by unauthenticated attackers.

The vulnerability received a CVSS score of 9.8 (critical). It was published on NVD on 2026-09-28. As of 2026-10-30, public repositories on GitHub claim to contain working exploit code. No non-standard configuration is required to exploit the flaw: the vulnerable endpoint is available on any internet-facing Apache Roller instance, regardless of global security settings.

Administrators must upgrade immediately to Apache Roller 6.1.6 or later, which disables extension types and rejects requests when XML-RPC is disabled. It is essential to inventory all Apache Roller instances in use and prioritize those exposed to the internet. In the period before patching, carefully examine XML-RPC endpoint logs for traces of anomalous access or exploitation attempts.