Expression injection via orQueries in Camunda 7 task queries enables OS command execution (CVE-2026-109432)
VulnCheck's canary sensors recorded exploitation attempts on 2026-10-28 and VulnCheck added the flaw to its KEV catalog the same day, so an unpatched Camunda engine that attackers can reach risks command execution on the host.
AdhocQueryValidator.validate() does not check the expression maps of sub-queries in the orQueries field of TaskQueryDto. That gets around the enableExpressionsInAdhocQueries restriction and lets a malicious JUEL expression (for example dueAfterExpression) call java.lang.Runtime.exec. The result is operating-system command execution as the engine service user. VulnCheck's advisory says the attacker must be an authenticated user, while the CVE record's CVSS 4.0 vector scores it as needing no privileges, so treat any reachable REST API as at risk.
Affected: Camunda 7 7.24.0 through 7.24.13 (fixed in 7.24.14); Camunda 7 7.23.0 through 7.23.16 (fixed in 7.23.17)
How to Test
Check the running Camunda 7 engine version (in the web apps or the distribution's version information). Versions 7.24.0–7.24.13 and 7.23.0–7.23.16 are affected. In REST API access logs, look for task query requests whose bodies contain an orQueries array with expression fields such as dueAfterExpression, especially values that include reflection or Runtime.exec patterns. Also look for unexpected child processes started by the engine service user.
How to Patch
Upgrade Camunda 7 to 7.24.14 or later on the 7.24 branch, or to 7.23.17 or later on the 7.23 branch, using the Camunda enterprise download page. Until then, restrict network access to the Camunda REST API and web apps to trusted users and hosts.