CVE-2024-27348 KEVPublic exploit Critical · 9.8 EPSS 99.2%

Apache HugeGraph-Server Improper Access Control Vulnerability

Apache · HugeGraph-Server

Summary

Apache HugeGraph-Server contains an improper access control flaw in its server component, which allows remote command execution in versions from 1.0.0 before 1.3.0 running on Java 8 and Java 11. An attacker with network access can exploit it without authentication or user interaction, and the default configuration without the Auth system enabled is the exposed condition.

Official description · NVD

RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

Breakdown

73.7 / 100

Exploited: Yes, in CISA KEV
Reports: 1
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationAI-written (claude-haiku-5-5)Medium confidence149 general detection rules
What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterAI-written (claude-haiku-5-5)Medium confidence95 general detection rules

First seen exploited 3 months after disclosure. Public exploit code (Metasploit) was available the same day.

DisclosedPublic exploit codeMetasploit22 Apr 2024day 0
First seen exploitedVulnCheck KEV evidence15 Jul 2024+3 mo
Added to CISA KEVEU database agrees18 Sep 2024+5 mo
Named in a threat reportaquasec.com26 Nov 2024+7 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 3 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

AI mapping from the description · how it is exploited

remote exploitation of public-facing graph server; keyword query KW:T1190:1

RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server

From the official description (NVD) Original ↗

Exploit Public-Facing Application: Exploits vulnerabilities in IoT devices, routers, and servers such as HugeGraph (CVE-2024-27348) and Arcadyan firmware (CVE-2021-20090).

Matrix Unleashes A New Widespread DDoS Campaign aquasec.com, 26 Nov 2024 Original ↗

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium

AI mapping from the description · primary impact

remote command execution is direct impact

RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server

From the official description (NVD) Original ↗

Detection

0 rules for this CVE · 244 general rules for its techniques

Rules for this CVE

0 that reference CVE-2024-27348 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

2 packages in 1 ecosystem. No single main package: each of these ships the affected code.

Mavenorg.apache.hugegraph:hugegraph-api
Affected: 1.0.0 up to 1.3.0Upgrade to 1.3.0 or later
GHSA-29rc-vq7f-x335
Mavenorg.apache.hugegraph:hugegraph-core
Affected: 1.0.0 up to 1.3.0Upgrade to 1.3.0 or later
GHSA-29rc-vq7f-x335

Check your lockfile against all CVEs

What security researchers reported

Named in 1 threat report

1 reportAqua SecurityNov 2024

Reports are matched by finding the exact id CVE-2024-27348 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Aqua Security26 Nov 2024

Matrix Unleashes A New Widespread DDoS Campaign

CVE-2024-27348: Exploiting a vulnerability in Apache HugeGraph Server, specifically a hypothetical, which may allow for Remote Code Execution (RCE) via the Gremlin server endpoint.

3 passages name itOriginal (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 30, 202629 Oct 2026
Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
44 more on OTX

References

5 links, grouped by NVD tag (3 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 18 Sep 2024. Federal due date 9 Oct 2024. No recorded ransomware use.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

ENISA

Marked exploited since 18 Sep 2024. EUVD-2024-1059

Apache HugeGraph Server 1.2.0 - Remote Code Execution (RCE)EDB-52149 · webapps · java · 2025-04-09

, 30 Oct 2026

99.2%Top 0.07%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.94%).

3.1

9.8Critical · 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 838 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9993 20.0/20

Threat reports1 report 3.9/10

Public exploit code1 NVD reference tagged Exploit; 1 Exploit-DB entry; 6 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 9.8 6.9/7

End-of-life productsupported or unknown 0.0

Total73.7

Record

Published: 22 Apr 2024
Modified: 17 Jun 2026
: CWE-284 Improper Access Control
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ExecutionTA0002

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

What security researchers reported

Matrix Unleashes A New Widespread DDoS Campaign

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 1

US Government Resource 1

Third Party Advisory 2

Product 1

How attackers get in

What they do

techniques