CVE-2026-27466

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27466", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-19T17:25:31.101Z", "datePublished": "2026-02-21T07:14:49.851Z", "dateUpdated": "2026-02-24T18:48:15.788Z"}, "containers": {"cna": {"title": "BigBlueButton: Exposed ClamAV port enables Denial of Service", "problemTypes": [{"descriptions": [{"cweId": "CWE-668", "lang": "en", "description": "CWE-668: Exposure of Resource to Wrong Sphere", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-wmhx-qw2p-w6gc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-wmhx-qw2p-w6gc"}, {"name": "https://github.com/bigbluebutton/bigbluebutton/commit/f3d33d94a9682e87c7d41f55700b19d61e1ab8b4", "tags": ["x_refsource_MISC"], "url": "https://github.com/bigbluebutton/bigbluebutton/commit/f3d33d94a9682e87c7d41f55700b19d61e1ab8b4"}], "affected": [{"vendor": "bigbluebutton", "product": "bigbluebutton", "versions": [{"version": "< 3.0.22", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-21T07:14:49.851Z"}, "descriptions": [{"lang": "en", "value": "BigBlueButton is an open-source virtual classroom. In versions 3.0.21 and below, the official documentation for \"Server Customization\" on Support for ClamAV as presentation file scanner contains instructions that leave a BBB server vulnerable for Denial of Service. The flawed command exposes both ports (3310 and 7357) to the internet. A remote attacker can use this to send complex or large documents to clamd and waste server resources, or shutdown the clamd process. The clamd documentation explicitly warns about exposing this port. Enabling ufw (ubuntu firewall) during install does not help, because Docker routes container traffic through the nat table, which is not managed or restricted by ufw. Rules installed by ufw in the filter table have no effect on docker traffic. In addition, the provided example also mounts /var/bigbluebutton with write permissions into the container, which should not be required. Future vulnerabilities in clamd may allow attackers to manipulate files in that folder. Users are unaffected unless they have opted in to follow the extra instructions from BigBlueButton's documentation. This issue has been fixed in version 3.0.22."}], "source": {"advisory": "GHSA-wmhx-qw2p-w6gc", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T18:47:59.043540Z", "id": "CVE-2026-27466", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T18:48:15.788Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27466", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T18:47:59.043540Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T18:48:08.252Z"}}], "cna": {"title": "BigBlueButton: Exposed ClamAV port enables Denial of Service", "source": {"advisory": "GHSA-wmhx-qw2p-w6gc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "bigbluebutton", "product": "bigbluebutton", "versions": [{"status": "affected", "version": "< 3.0.22"}]}], "references": [{"url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-wmhx-qw2p-w6gc", "name": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-wmhx-qw2p-w6gc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/bigbluebutton/bigbluebutton/commit/f3d33d94a9682e87c7d41f55700b19d61e1ab8b4", "name": "https://github.com/bigbluebutton/bigbluebutton/commit/f3d33d94a9682e87c7d41f55700b19d61e1ab8b4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "BigBlueButton is an open-source virtual classroom. In versions 3.0.21 and below, the official documentation for \"Server Customization\" on Support for ClamAV as presentation file scanner contains instructions that leave a BBB server vulnerable for Denial of Service. The flawed command exposes both ports (3310 and 7357) to the internet. A remote attacker can use this to send complex or large documents to clamd and waste server resources, or shutdown the clamd process. The clamd documentation explicitly warns about exposing this port. Enabling ufw (ubuntu firewall) during install does not help, because Docker routes container traffic through the nat table, which is not managed or restricted by ufw. Rules installed by ufw in the filter table have no effect on docker traffic. In addition, the provided example also mounts /var/bigbluebutton with write permissions into the container, which should not be required. Future vulnerabilities in clamd may allow attackers to manipulate files in that folder. Users are unaffected unless they have opted in to follow the extra instructions from BigBlueButton's documentation. This issue has been fixed in version 3.0.22."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-668", "description": "CWE-668: Exposure of Resource to Wrong Sphere"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-21T07:14:49.851Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27466", "state": "PUBLISHED", "dateUpdated": "2026-02-24T18:48:15.788Z", "dateReserved": "2026-02-19T17:25:31.101Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-21T07:14:49.851Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "bigbluebutton", "vendor": "bigbluebutton", "versions": [{"status": "affected", "version": "< 3.0.22"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*", "matchCriteriaId": "2F947DE6-4258-49E7-923E-8607DFEA6708", "versionEndExcluding": "3.0.22", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "BigBlueButton is an open-source virtual classroom. In versions 3.0.21 and below, the official documentation for \"Server Customization\" on Support for ClamAV as presentation file scanner contains instructions that leave a BBB server vulnerable for Denial of Service. The flawed command exposes both ports (3310 and 7357) to the internet. A remote attacker can use this to send complex or large documents to clamd and waste server resources, or shutdown the clamd process. The clamd documentation explicitly warns about exposing this port. Enabling ufw (ubuntu firewall) during install does not help, because Docker routes container traffic through the nat table, which is not managed or restricted by ufw. Rules installed by ufw in the filter table have no effect on docker traffic. In addition, the provided example also mounts /var/bigbluebutton with write permissions into the container, which should not be required. Future vulnerabilities in clamd may allow attackers to manipulate files in that folder. Users are unaffected unless they have opted in to follow the extra instructions from BigBlueButton's documentation. This issue has been fixed in version 3.0.22."}, {"lang": "es", "value": "BigBlueButton es un aula virtual de c\u00f3digo abierto. En las versiones 3.0.21 e inferiores, la documentaci\u00f3n oficial para 'Personalizaci\u00f3n del Servidor' en Soporte para ClamAV como esc\u00e1ner de archivos de presentaci\u00f3n contiene instrucciones que dejan un servidor BBB vulnerable a la denegaci\u00f3n de servicio. El comando defectuoso expone ambos puertos (3310 y 7357) a internet. Un atacante remoto puede usar esto para enviar documentos complejos o grandes a clamd y malgastar recursos del servidor, o apagar el proceso clamd. La documentaci\u00f3n de clamd advierte expl\u00edcitamente sobre la exposici\u00f3n de este puerto. Habilitar ufw (cortafuegos de ubuntu) durante la instalaci\u00f3n no ayuda, porque Docker enruta el tr\u00e1fico del contenedor a trav\u00e9s de la tabla nat, la cual no es gestionada ni restringida por ufw. Las reglas instaladas por ufw en la tabla de filtros no tienen efecto en el tr\u00e1fico de docker. Adem\u00e1s, el ejemplo proporcionado tambi\u00e9n monta /var/bigbluebutton con permisos de escritura en el contenedor, lo cual no deber\u00eda ser necesario. Futuras vulnerabilidades en clamd pueden permitir a los atacantes manipular archivos en esa carpeta. Los usuarios no se ven afectados a menos que hayan optado por seguir las instrucciones adicionales de la documentaci\u00f3n de BigBlueButton. Este problema ha sido solucionado en la versi\u00f3n 3.0.22."}], "id": "CVE-2026-27466", "lastModified": "2026-06-17T10:27:11.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27466", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T18:47:59.043540Z", "version": "2.0.3"}}]}, "published": "2026-02-21T08:16:11.647", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/bigbluebutton/bigbluebutton/commit/f3d33d94a9682e87c7d41f55700b19d61e1ab8b4"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-wmhx-qw2p-w6gc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-668"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.0.22)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "bigbluebutton", "source": "cna", "vendor": "bigbluebutton"}, "product": "bigbluebutton", "vendor": "bigbluebutton"}], "analysis": {"en": {"generated_at": "2026-04-17T16:50:33.780354+00:00", "value": {"mitigation_remediation": ["Upgrade BigBlueButton to version 3.0.22 or later, where the defect is resolved.", "Configure firewall rules to block external access to ClamAV ports 3310 and 7357, ensuring that Docker\u2019s NAT table is controlled or that container port publishing is disabled.", "Remove the unnecessary write permission on /var/bigbluebutton in the Docker volume mount or restrict the mount to read\u2011only to minimize the attack surface."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The issue affects installations of BigBlueButton version 3.0.21 and earlier that adopted the extra configuration steps described in the official Server Customization guide. Systems that did not enable the optional ClamAV integration remain unaffected. The vulnerability involves the Docker image used by BigBlueButton, where the container exposes the ClamAV daemon ports to the external network and mounts the host\u2019s /var/bigbluebutton directory with write access inside the container, potentially allowing future exploitation of clamd files.", "description_and_impact": "The vulnerability arises from misconfigured documentation instructions that expose ClamAV daemon ports 3310 and 7357 to the internet. A remote attacker who can reach these exposed ports can submit exceptionally large or maliciously constructed documents to the ClamAV daemon, draining server resources or triggering a termination of the clamd process, thereby disabling document scanning and disrupting classroom sessions. The flaw is a configuration error, classified under CWE-668: Improper Control of a Resource Through an Untrusted Source.", "risk_and_exploitability": "The CVSS score of 7.2 indicates a high severity of denial\u2011of\u2011service impact. The EPSS score is below 1\u202f%, suggesting the probability of exploitation is low but not zero. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires network reachability to the compromised ports, which by design are reachable from the public internet in the affected configuration. Given the simplicity of connecting to a TCP port and sending data, attackers can repeatedly trigger service degradation without needing privileged credentials."}}}}, "created": "2026-02-23T14:32:24.863451+00:00", "updated": "2026-04-17T17:00:10.171463+00:00", "vendors": ["bigbluebutton", "bigbluebutton$PRODUCT$bigbluebutton"]}