CVE-2025-59059: RCE in Apache Ranger Plugins Common

The NashornScriptEngineCreator component in Apache Ranger Plugins Common is vulnerable to RCE. An attacker could craft malicious scripts that, when processed by the component, would lead to arbitrary code execution on the server. This could grant the attacker complete control over the Ranger server, enabling them to steal sensitive data, modify configurations, or even pivot to other systems within the network. The potential impact is significant, as Ranger is often used to manage and enforce security policies across various data sources, making it a high-value target for attackers. Successful exploitation could lead to widespread data breaches and system compromise.

1. Reserved2025-09-08
2. Published2026-03-03
3. Modified2026-03-09
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-59059 is to upgrade Apache Ranger Plugins Common to version 2.8.0 or later, which contains the fix. If an immediate upgrade is not feasible due to compatibility issues or downtime constraints, consider implementing temporary workarounds. While no specific WAF rules are readily available, restricting access to the NashornScriptEngineCreator component or implementing strict input validation on any scripts processed by it could reduce the attack surface. Monitor Ranger logs for any suspicious activity related to script execution. After upgrading, confirm the fix by attempting to execute a known malicious script and verifying that it is blocked or handled safely.