RCE in Apache Continuum
CVE-2016-15057
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum. This issue affects Apache Continuum: all versions. Attackers with access to the installations REST API can use this to invoke arbitrary commands on the server. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.038 (89.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Apache Continuum
- Apache Software Foundation Continuum — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (vendor-advisory, Mailing List)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2016-15057?
- CVE-2016-15057 is a critical-severity vulnerability in Apache Continuum, classified under Command Injection. CVSS score: 9.9/10. Published 2026-01-26.
- How severe is CVE-2016-15057?
- Critical severity. CVSS v3 base score is 9.9 out of 10.
- Is CVE-2016-15057 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.