CVE-2025-13426

The record

A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution. It is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute arbitrary Java code and system commands at runtime, leading to unauthorized access to data, lateral movement within the network, and access to backend systems. The Apigee hybrid versions below have all been updated to protect from this vulnerability: * Hybrid_1.11.2+ * Hybrid_1.12.4+ * Hybrid_1.13.3+ * Hybrid_1.14.1+ * OPDK_5202+ * OPDK_5300+

Affected packages

Related vulnerabilities

• CVE-2026-92953 vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer… CWE-913
• CVE-2026-92955 vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers… CWE-913
• CVE-2026-92946 vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is… CWE-913
• CVE-2026-92935 vm2 is a sandbox for running untrusted Node.js code. CWE-913
• CVE-2026-65181 Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with… CWE-913
• CVE-2026-41870 Missing Authorization, Improper Control of Generation of Code ('Code Injection')… CWE-913
• CVE-2026-84430 A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. CWE-913
• CVE-2026-59283 Applications that evaluate Spring Expression Language (SpEL) expressions using… CWE-913