CVE-2026-11458: erzhongxmu JeeWMS Boot Actuator Endpoint actuator information disclosure
A weakness has been identified in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This issue affects some unknown processing of the file /base-boot/actuator of the component Boot Actuator Endpoint. Executing a manipulation can lead to information disclosure. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
erzhongxmu JeeWMS Boot Actuator Endpointfrom your environment.Uninstall or remove the Boot Actuator Endpoint component (the /base-boot/actuator functionality) if it is not required by your environment to eliminate the vulnerable component.
- Configuration
Disable the Boot Actuator Endpoint (the /base-boot/actuator endpoint) if it is not required by the deployment to prevent remote information disclosure.
Boot Actuator Endpoint actuator_endpoint_enabled = false - Compensating control
Restrict access to the /base-boot/actuator endpoint to trusted IPs or internal networks (firewall, network ACLs, or WAF) and require authentication/authorization for access to actuator endpoints until a vendor fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11458?
The severity of CVE-2026-11458 is rated as medium with a score of 5.3.
What type of vulnerability is CVE-2026-11458?
CVE-2026-11458 is classified as an information disclosure vulnerability.
How do I fix CVE-2026-11458?
To fix CVE-2026-11458, update to the latest version of erzhongxmu JeeWMS that addresses this vulnerability.
What component is affected by CVE-2026-11458?
CVE-2026-11458 affects the Boot Actuator Endpoint component of erzhongxmu JeeWMS.
What can be the impact of CVE-2026-11458?
The impact of CVE-2026-11458 can lead to unauthorized information disclosure from the affected Boot Actuator Endpoint.