CVE-2025-13426

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13426", "assignerOrgId": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "state": "PUBLISHED", "assignerShortName": "GoogleCloud", "dateReserved": "2025-11-19T16:10:26.041Z", "datePublished": "2025-12-05T21:27:13.711Z", "dateUpdated": "2025-12-08T17:27:42.517Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apigee hybrid Javacallout policy", "vendor": "Google Cloud", "versions": [{"lessThan": "Hybrid_1.11.2", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Hybrid_1.12.4", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Hybrid_1.13.3", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Hybrid_1.14.1", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "OPDK_5202", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "OPDK_5300", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Nikita Markevich"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A vulnerability exists in Google <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.apigee.com/api-platform/reference/policies/java-callout-policy\">Apigee's JavaCallout policy</a> that allows for remote code execution.</p>It is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute arbitrary Java code and system commands at runtime,&nbsp;leading to unauthorized access to data, lateral movement within the network, and access to backend systems.<br><br><span style=\"background-color: rgb(255, 255, 255);\"><span style=\"background-color: rgb(252, 252, 252);\">The Apigee hybrid versions below have all been updated to protect from this vulnerability:</span><br></span><ul><li>Hybrid_1.11.2+</li><li>Hybrid_1.12.4+</li><li>Hybrid_1.13.3+</li><li>Hybrid_1.14.1+</li><li>OPDK_5202+</li><li>OPDK_5300+</li></ul>"}], "value": "A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution.\n\nIt is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute arbitrary Java code and system commands at runtime,\u00a0leading to unauthorized access to data, lateral movement within the network, and access to backend systems.\n\nThe Apigee hybrid versions below have all been updated to protect from this vulnerability:\n * Hybrid_1.11.2+\n * Hybrid_1.12.4+\n * Hybrid_1.13.3+\n * Hybrid_1.14.1+\n * OPDK_5202+\n * OPDK_5300+"}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "CLEAR", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Clear", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-913", "description": "CWE-913 Improper Control of Dynamically-Managed Code Resources", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "shortName": "GoogleCloud", "dateUpdated": "2025-12-05T21:27:13.711Z"}, "references": [{"url": "https://docs.cloud.google.com/apigee/docs/hybrid/release-notes#March_01_2025"}], "source": {"discovery": "UNKNOWN"}, "title": "Improper Sandboxing in Google Apigee's JavaCallout Policy Allows for Remote Code Execution", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-08T17:27:37.360144Z", "id": "CVE-2025-13426", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-08T17:27:42.517Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13426", "assignerOrgId": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "state": "PUBLISHED", "assignerShortName": "GoogleCloud", "dateReserved": "2025-11-19T16:10:26.041Z", "datePublished": "2025-12-05T21:27:13.711Z", "dateUpdated": "2025-12-08T17:27:42.517Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apigee hybrid Javacallout policy", "vendor": "Google Cloud", "versions": [{"lessThan": "Hybrid_1.11.2", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Hybrid_1.12.4", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Hybrid_1.13.3", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Hybrid_1.14.1", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "OPDK_5202", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "OPDK_5300", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Nikita Markevich"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A vulnerability exists in Google <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.apigee.com/api-platform/reference/policies/java-callout-policy\">Apigee's JavaCallout policy</a> that allows for remote code execution.</p>It is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute arbitrary Java code and system commands at runtime,&nbsp;leading to unauthorized access to data, lateral movement within the network, and access to backend systems.<br><br><span style=\"background-color: rgb(255, 255, 255);\"><span style=\"background-color: rgb(252, 252, 252);\">The Apigee hybrid versions below have all been updated to protect from this vulnerability:</span><br></span><ul><li>Hybrid_1.11.2+</li><li>Hybrid_1.12.4+</li><li>Hybrid_1.13.3+</li><li>Hybrid_1.14.1+</li><li>OPDK_5202+</li><li>OPDK_5300+</li></ul>"}], "value": "A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution.\n\nIt is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute arbitrary Java code and system commands at runtime,\u00a0leading to unauthorized access to data, lateral movement within the network, and access to backend systems.\n\nThe Apigee hybrid versions below have all been updated to protect from this vulnerability:\n * Hybrid_1.11.2+\n * Hybrid_1.12.4+\n * Hybrid_1.13.3+\n * Hybrid_1.14.1+\n * OPDK_5202+\n * OPDK_5300+"}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "CLEAR", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Clear", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-913", "description": "CWE-913 Improper Control of Dynamically-Managed Code Resources", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "shortName": "GoogleCloud", "dateUpdated": "2025-12-05T21:27:13.711Z"}, "references": [{"url": "https://docs.cloud.google.com/apigee/docs/hybrid/release-notes#March_01_2025"}], "source": {"discovery": "UNKNOWN"}, "title": "Improper Sandboxing in Google Apigee's JavaCallout Policy Allows for Remote Code Execution", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13426", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-08T17:27:37.360144Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T21:46:30.406Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apigee hybrid Javacallout policy", "vendor": "Google Cloud", "versions": [{"lessThan": "Hybrid_1.11.2", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Hybrid_1.12.4", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Hybrid_1.13.3", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Hybrid_1.14.1", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "OPDK_5202", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "OPDK_5300", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution.\n\nIt is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute arbitrary Java code and system commands at runtime,\u00a0leading to unauthorized access to data, lateral movement within the network, and access to backend systems.\n\nThe Apigee hybrid versions below have all been updated to protect from this vulnerability:\n * Hybrid_1.11.2+\n * Hybrid_1.12.4+\n * Hybrid_1.13.3+\n * Hybrid_1.14.1+\n * OPDK_5202+\n * OPDK_5300+"}, {"lang": "es", "value": "Existe una vulnerabilidad en la pol\u00edtica JavaCallout de Google Apigee https://docs.apigee.com/api-platform/reference/policies/java-callout-policy que permite la ejecuci\u00f3n remota de c\u00f3digo.\n\nEs posible que un usuario escriba un JavaCallout que inyecte un objeto malicioso en el MessageContext para ejecutar c\u00f3digo Java arbitrario y comandos del sistema en tiempo de ejecuci\u00f3n, lo que lleva a un acceso no autorizado a los datos, movimiento lateral dentro de la red y acceso a sistemas de backend.\n\nLas versiones h\u00edbridas de Apigee a continuaci\u00f3n han sido todas actualizadas para protegerse de esta vulnerabilidad:\n * Hybrid_1.11.2+\n * Hybrid_1.12.4+\n * Hybrid_1.13.3+\n * Hybrid_1.14.1+\n * OPDK_5202+\n * OPDK_5300+"}], "id": "CVE-2025-13426", "lastModified": "2026-09-25T23:10:00.463", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "CLEAR", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13426", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-08T17:27:37.360144Z", "version": "2.0.3"}}]}, "published": "2025-12-05T22:15:47.793", "references": [{"source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "url": "https://docs.cloud.google.com/apigee/docs/hybrid/release-notes#March_01_2025"}], "sourceIdentifier": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-913"}], "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "type": "Secondary"}]}

{}

{"created": "2025-12-08T09:39:53.521575+00:00", "updated": "2025-12-08T09:39:53.521602+00:00", "vendors": ["google", "google$PRODUCT$cloud_apigee"]}