Remote Code Exploit in Lucee Admin
Priority CRITICAL 85CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.
Summary
Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As a workaround, one can block access to the Lucee Administrator.
Why it matters now
EPSS 0.89189 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Lucee (lucee): 5.3.5.96, 5.3.6.68, 5.3.7.47
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| lucee | Lucee | 5.3.5.0 to before 5.3.5.96; 5.3.6.0 to before 5.3.6.68; 5.3.7.0 to before 5.3.7.47 | 5.3.5.96, 5.3.6.68, 5.3.7.47 | Patch available | CNA |
- Lucee Vendorlucee Affected 5.3.5.0 to before 5.3.5.96; 5.3.6.0 to before 5.3.6.68; 5.3.7.0 to before 5.3.7.47 Fixed in 5.3.5.96, 5.3.6.68, 5.3.7.47 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:lucee:lucee_server:*:*:*:*:*:*:*:* | 5.3.5.00 to before 5.3.5.96; 5.3.6.00 to before 5.3.6.68; 5.3.7.00 to before 5.3.7.47 | Vulnerable | lucee |
- cpe:2.3:a:lucee:lucee_server:*:*:*:*:*:*:*:* Versions 5.3.5.00 to before 5.3.5.96; 5.3.6.00 to before 5.3.6.68; 5.3.7.00 to before 5.3.7.47 Vulnerable ·lucee
Remediation
- Fix · CNA Lucee (lucee) Fixed in 5.3.5.96, 5.3.6.68, 5.3.7.47
Timeline
- 2026-10-02 Threatist record created from CVE-2021-21307
References
Exploit 2
Patch 2
Advisory 2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences