CVE-2026-79986

Apache Camel critical path traversal, CVSS 9.1.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when del

Start free with one domain How we watch for this

9.1CVSS base score: critical, the highest band

1.0%chance of exploitation in the next 30 days (EPSS), 63rd percentile

19 Octfirst published, 2026

Not yeton CISA's exploited list, as of 14 November 2026

Vendor and product	Apache Software Foundation · Apache Camel
Type	path traversal
Severity	Critical 9.1 CVSS base score
Affected versions	Apache Camel: 4.0.0 to before 4.18.5, 4.19.0 to before 4.22.1
First published	19 October 2026
Weakness	CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploited	Not confirmed. Critical flaws in Apache Software Foundation products have been exploited before: Apache Software Foundation appears on CISA's exploited list.
Advisories	camel.apache.org ↗ · github.com ↗ · github.com ↗

What to do

Patch before it is exploited

Step 1

Apply the vendor fix.

Step 2

Assume files readable through the flaw were read: rotate secrets and keys stored on the system.

Step 3

Restrict access to the interface until patched.

Is it on your estate?

Know the day it starts being used

Threat Landscape Monitoring fingerprints the software your internet-facing hosts disclose and tells you the day a vulnerability on them is confirmed exploited, with the host and the fix. The free plan covers one domain.

Start free with one domain

Questions

CVE-2026-79986 in short

Is CVE-2026-79986 being exploited?

Not confirmed as of 14 November 2026: CISA has not added it to its Known Exploited Vulnerabilities catalogue. Critical flaws in Apache Software Foundation products are a frequent target, so patch before that changes; this page is updated daily.

How severe is CVE-2026-79986?

NVD rates it critical, with a CVSS base score of 9.1.

Which versions of Apache Camel are affected by CVE-2026-79986?

According to the CVE record: Apache Camel: 4.0.0 to before 4.18.5, 4.19.0 to before 4.22.1. Check the vendor's advisory for the fixed version.

How do I fix CVE-2026-79986?

Apply the vendor fix. Assume files readable through the flaw were read: rotate secrets and keys stored on the system. Restrict access to the interface until patched.

Sources: NVD, the CVE record, FIRST EPSS and the CISA Known Exploited Vulnerabilities catalogue. Page compiled automatically by SAK T.L.M, the threat-intelligence tool of SAK T.E.C, on 14 November 2026.