CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-67208 — Juggle through 1.6.0 contains a remote code execution vulnerability that allows ...

·Source: NIST NVD

Updated:

Executive Summary

Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint, authenticate with default credentials, and leverage the H2 CREATE ALIAS Runtime.exec() technique to execute

Analysis

Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint, authenticate with default credentials, and leverage the H2 CREATE ALIAS Runtime.exec() technique to execute arbitrary commands, resulting in root-level code execution when running the stock Docker image. CVSS Score: 9.8. Published: 2026-07-30T20:18:14.323.

Indicators of Compromise (1)

CVE (1)
CVE-2026-67208
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 30, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

CISA Urges Water Sector to Protect OT After Coordinated Attacks on PLCs

CISA is urging water and wastewater utilities to lock down internet-exposed controllers, days after intrusions hit dozens of Minnesota systems. The post CISA Urges Water Sector to Protect OT After Coordinated Attacks on PLCs appeared first on SecurityWeek .

SecurityWeek
CRITICALVulnerability

JetBrains warns of critical TeamCity remote code execution flaw

JetBrains is warning of a critical authentication bypass vulnerability affecting TeamCity On-Premises that could be exploited to achieve remote code execution. [...]

BleepingComputer
MEDIUMVulnerability

FTC Sues Telehealth Firm Hims & Hers Over Data Sharing

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/ftc-sues-telehealth-firm-hims-hers-over-data-sharing-image_small-1-a-32376.jpg" align=right hspace=4><b>Feds May Renew Crackdown on Violations Related to Online Health Data Trackers</b><br>The Federal Trade Commission, along with Utah and California, have filed a lawsuit against telehealth firm Hims & Hers accusing the company of

Bank Info Security