8.7High
CVE-2026-6009Jaspersoft Library Deserialisation Vulnerability
Description
Java Deserialisation Vulnerability in Jaspersoft Reports Library leads to Remote Code Execution (RCE), potentially allowing code execution on the affected system
Weakness (CWE):
CWE-502
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Jaspersoft | JasperReports IO At-Scale | ≤ 10.0.0 | |
| Jaspersoft | JasperReports IO Professional | ≤ 10.0.0 | |
| Jaspersoft | JasperReports Library Community Edition | ≤ 7.0.6 | |
| Jaspersoft | JasperReports Library Professional | ≤ 10.0.0 | |
| Jaspersoft | JasperReports Server | ≤ 10.0.0 | |
| Jaspersoft | JasperReports Web Studio | ≤ 10.0.1 | |
| Jaspersoft | Jaspersoft Studio Community Edition | ≤ 7.0.6 | |
| Jaspersoft | Jaspersoft Studio Professional | ≤ 10.0.0 |