CVE-2026-19135 in Horizon
Summary
by MITRE • 08/13/2026
A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an attacker to gain access to confidential information and compromise integrity.
The solution is to upgrade to Meridian 2024.3.12, 2025.0.9 and Horizon 36.0.3 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability described represents a critical sandbox escape issue in OpenNMS Meridian and Horizon platforms, specifically affecting JEXL expression evaluation mechanisms. This security flaw allows authenticated users with low privileges to bypass the intended execution boundaries of the system's scripting environment through carefully crafted inputs submitted via the Measurements REST API endpoint. The vulnerability stems from inadequate validation and sanitization of user-supplied expressions that are processed within the JEXL engine, which is designed to provide a safe execution context for formula evaluation but fails to properly restrict class loading operations.
The technical implementation of this vulnerability leverages weaknesses in the expression parser's handling of Java class loading mechanisms within the sandbox environment. When processing maliciously constructed JEXL expressions, the system fails to adequately constrain the dynamic class resolution capabilities that should be restricted to prevent arbitrary code execution. This represents a direct violation of secure coding principles and sandboxing methodologies that are fundamental to preventing privilege escalation and unauthorized resource access. The vulnerability aligns with CWE-749, which addresses exposed dangerous methods or operations in software systems. Attackers can exploit this weakness to load arbitrary Java classes from the server's classpath, potentially gaining access to sensitive system resources, configuration data, and other confidential information stored within the OpenNMS environment.
The operational impact of this vulnerability extends beyond simple privilege escalation to encompass potential data compromise and system integrity violations. An attacker who successfully exploits this vulnerability could execute arbitrary code with the privileges of the OpenNMS service account, potentially leading to full system compromise or unauthorized access to network monitoring data and configuration information. This threat landscape aligns with ATT&CK technique T1059.007 for execution through scripting and T1566 for credential access through social engineering components that might be present in the compromised environment. The vulnerability's exploitation requires only authenticated access, making it particularly dangerous as it can be leveraged by insiders or attackers who have obtained legitimate credentials.
Organizations utilizing affected versions of OpenNMS should immediately implement the recommended mitigation strategies, including upgrading to Meridian 2024.3.12, 2025.0.9, and Horizon 36.0.3 or newer releases that contain the necessary patches. The upgrade process should be carefully planned to minimize service disruption while ensuring complete remediation of the vulnerability. Additionally, network security controls should be implemented to restrict direct internet access to OpenNMS installations as specified in the vendor's documentation, since these systems are explicitly designed for private network deployment and should never be exposed directly to external threats. The recommended approach includes implementing strict network segmentation, firewall rules, and monitoring solutions to detect potential exploitation attempts, while also maintaining regular security assessments to identify similar vulnerabilities in other components of the system infrastructure.