CVE-2014-9000

Mule Enterprise Management Console - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-9000. PoCs published by Brandon Perry.

AI-analyzed exploit summary This exploit demonstrates an authenticated privilege escalation vulnerability in Mulesoft ESB Runtime 3.5.1. By sending a crafted HTTP POST request to the /handler/securityService.rpc endpoint, any authenticated user can create an administrator account, enabling remote code execution through WAR deployment or Groovy script evaluation.

Description

Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC.

Exploits (1)

exploitdb WORKING POC
by Brandon Perry · textwebappsjsp
https://www.exploit-db.com/exploits/35079

This exploit demonstrates an authenticated privilege escalation vulnerability in Mulesoft ESB Runtime 3.5.1. By sending a crafted HTTP POST request to the /handler/securityService.rpc endpoint, any authenticated user can create an administrator account, enabling remote code execution through WAR deployment or Groovy script evaluation.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Mulesoft ESB Runtime 3.5.1
Auth required
Prerequisites: Authenticated user access with any role (e.g., Monitor)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Oct/107
Exploit mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Oct/98

Scores

EPSS 0.0887
EPSS Percentile 94.5%

Details

CWE
CWE-264
Status published
Products (1)
mulesoft/mule_enterprise_management_console
Published Nov 20, 2014
Tracked Since Feb 18, 2026