CVE-2026-66756

Apache Tika suffered a critical improper protection of alternate path vulnerability allowing remote code execution.

CVE-2026-66756 in Apache Tika allows attackers to execute arbitrary code via an alternate path vulnerability, posing a severe risk to systems processing documents. DIB organizations must ensure their document processing pipelines are patched to version 4.0.0-beta-1 or later to prevent potential compromise of sensitive data and systems.

Shame score — A critical CVSS 9.8 vulnerability in a widely used document processing library was left unpatched long enough to be exploited in the wild, demonstrating severe negligence in maintaining secure software supply chains.