CVE-2025-13426

A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution. It is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute arbitrary Java code and system commands at runtime, leading to unauthorized access to data, lateral movement within the network, and access to backend systems. The Apigee hybrid versions below have all been updated to protect from this vulnerability: * Hybrid_1.11.2+ * Hybrid_1.12.4+ * Hybrid_1.13.3+ * Hybrid_1.14.1+ * OPDK_5202+ * OPDK_5300+

CVSS

No CVSS.

References

Link	Resource
https://docs.cloud.google.com/apigee/docs/hybrid/release-notes#March_01_2025

Configurations

No configuration.

History

25 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad en la política JavaCallout de Google Apigee https://docs.apigee.com/api-platform/reference/policies/java-callout-policy que permite la ejecución remota de código. Es posible que un usuario escriba un JavaCallout que inyecte un objeto malicioso en el MessageContext para ejecutar código Java arbitrario y comandos del sistema en tiempo de ejecución, lo que lleva a un acceso no autorizado a los datos, movimiento lateral dentro de la red y acceso a sistemas de backend. Las versiones híbridas de Apigee a continuación han sido todas actualizadas para protegerse de esta vulnerabilidad: * Hybrid_1.11.2+ * Hybrid_1.12.4+ * Hybrid_1.13.3+ * Hybrid_1.14.1+ * OPDK_5202+ * OPDK_5300+

Information

Published : 2025-12-05 22:15

Updated : 2026-09-25 23:10

NVD link : CVE-2025-13426

Mitre link : CVE-2025-13426

CVE.ORG link : CVE-2025-13426

JSON object : View

Products Affected

No product.

CWE

CWE-913

Improper Control of Dynamically-Managed Code Resources

{"id": "CVE-2025-13426", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13426", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-08T17:27:37.360144Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "CLEAR", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "affectedData": [{"vendor": "Google Cloud", "product": "Apigee hybrid Javacallout policy", "versions": [{"status": "affected", "version": "0", "lessThan": "Hybrid_1.11.2", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "Hybrid_1.12.4", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "Hybrid_1.13.3", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "Hybrid_1.14.1", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "OPDK_5202", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "OPDK_5300", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-05T22:15:47.793", "references": [{"url": "https://docs.cloud.google.com/apigee/docs/hybrid/release-notes#March_01_2025", "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "description": [{"lang": "en", "value": "CWE-913"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution.\n\nIt is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute arbitrary Java code and system commands at runtime,\u00a0leading to unauthorized access to data, lateral movement within the network, and access to backend systems.\n\nThe Apigee hybrid versions below have all been updated to protect from this vulnerability:\n * Hybrid_1.11.2+\n * Hybrid_1.12.4+\n * Hybrid_1.13.3+\n * Hybrid_1.14.1+\n * OPDK_5202+\n * OPDK_5300+"}, {"lang": "es", "value": "Existe una vulnerabilidad en la pol\u00edtica JavaCallout de Google Apigee https://docs.apigee.com/api-platform/reference/policies/java-callout-policy que permite la ejecuci\u00f3n remota de c\u00f3digo.\n\nEs posible que un usuario escriba un JavaCallout que inyecte un objeto malicioso en el MessageContext para ejecutar c\u00f3digo Java arbitrario y comandos del sistema en tiempo de ejecuci\u00f3n, lo que lleva a un acceso no autorizado a los datos, movimiento lateral dentro de la red y acceso a sistemas de backend.\n\nLas versiones h\u00edbridas de Apigee a continuaci\u00f3n han sido todas actualizadas para protegerse de esta vulnerabilidad:\n * Hybrid_1.11.2+\n * Hybrid_1.12.4+\n * Hybrid_1.13.3+\n * Hybrid_1.14.1+\n * OPDK_5202+\n * OPDK_5300+"}], "lastModified": "2026-09-25T23:10:00.463", "sourceIdentifier": "f45cbf4e-4146-4068-b7e1-655ffc2c548c"}