Description
A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution. It is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute arbitrary Java code and system commands at runtime, leading to unauthorized access to data, lateral movement within the network, and access to backend systems. The Apigee hybrid versions below have all been updated to protect from this vulnerability: * Hybrid_1.11.2+ * Hybrid_1.12.4+ * Hybrid_1.13.3+ * Hybrid_1.14.1+ * OPDK_5202+ * OPDK_5300+
Scores
CVSS v4
8.7
EPSS
0.0062
EPSS Percentile
70.0%
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Clear
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-913
Status
published
Products (6)
Google Cloud/Apigee hybrid Javacallout policy
< Hybrid_1.11.2
Google Cloud/Apigee hybrid Javacallout policy
< Hybrid_1.12.4
Google Cloud/Apigee hybrid Javacallout policy
< Hybrid_1.13.3
Google Cloud/Apigee hybrid Javacallout policy
< Hybrid_1.14.1
Google Cloud/Apigee hybrid Javacallout policy
< OPDK_5202
Google Cloud/Apigee hybrid Javacallout policy
< OPDK_5300
Published
Dec 05, 2025
Tracked Since
Feb 18, 2026