EIP-2026-118724

PRE-CVE

Liferay Portal 7.0.0 M1/7.0.0 M2/7.0.0 M3 - Remote Code Execution

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-118724. PoCs published by drone.

AI-analyzed exploit summary This script exploits a pre-authentication command injection vulnerability in Liferay Portal 7.0.0 M1-M3 via an exposed Apache Felix interface on port 11311. It uses telnet to send commands to the target system, achieving remote code execution.

Description

Liferay Portal 7.0.0 M1/7.0.0 M2/7.0.0 M3 - Remote Code Execution

Exploits (1)

exploitdb WORKING POC
by drone · bashremotewindows
https://www.exploit-db.com/exploits/35652

This script exploits a pre-authentication command injection vulnerability in Liferay Portal 7.0.0 M1-M3 via an exposed Apache Felix interface on port 11311. It uses telnet to send commands to the target system, achieving remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Liferay Portal 7.0.0 M1, 7.0.0 M2, 7.0.0 M3
No auth needed
Prerequisites: Apache Felix interface exposed on port 11311 · Network access to the target system
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026