RCE in Com.ritense.valtimo Case
CVE-2026-42555
Valtimo is an open-source business process automation platform. com.ritense.valtimo:document from 12.0.0 to before 12.32.0, com.ritense.valtimo:case from 13.0.0 to before 13.23.0, and com.ritense.valtimo:contract from 13.4.0 to before 13.23.0 evaluate Spring Expression Language (SpEL) expressions from user-supplied input using StandardEvaluationContext, which provides unrestricted access to Java types and methods. An authenticated user with the ADMIN role can achieve Remote Code Execution and credential exfiltration. This vulnerability is fixed in com.ritense.valtimo:document 2.32.0, com.ritense.valtimo:case 13.23.0, and com.ritense.valtimo:contract 13.23.0.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (55.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 56th percentile — 55.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.008 · change: +0.002
Affected products
- Com.ritense.valtimo Case — versions >= 13.0.0, < 13.23.0
- Com.ritense.valtimo Contract — versions >= 13.4.0, < 13.23.0
- Com.ritense.valtimo Document — versions >= 12.0.0, < 12.32.0
- Valtimo-Platform Valtimo — versions < 13.23.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-42555?
- CVE-2026-42555 is a critical-severity vulnerability in Com.ritense.valtimo Case, classified under Code Injection. CVSS score: 9.1/10. Published 2026-05-14.
- How severe is CVE-2026-42555?
- Critical severity. CVSS v3 base score is 9.1 out of 10.