CVE-2026-28564 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-28564 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-28564 is an insufficient session expiration and authentication bypass via capture-replay vulnerability affecting Apache IoTDB, specifically in its REST interface where Basic Authentication accepts stale cached credentials.

Technical Detail

The flaw exists in Apache IoTDB's REST API authentication layer, which fails to properly invalidate or expire cached credentials after a session ends or a password change occurs. An attacker who captures valid Basic Authentication credentials, through network interception or credential theft, can replay those credentials to authenticate successfully even after they should no longer be valid. If exploited, this results in unauthorized access to the IoTDB instance, potentially allowing data exfiltration, manipulation of time-series data, or further lateral movement depending on the privileges associated with the replayed credentials.

Exploitation Status

No known exploit exists for this vulnerability at this time. The exploit maturity is currently assessed as zero, meaning no public proof-of-concept code, weaponized tooling, or confirmed in-the-wild exploitation has been observed. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of July 17, 2026.

Who Is Targeting This

No specific threat actor attribution at this time. There are no confirmed actors linked to exploitation of this vulnerability. Reported attribution notes the absence of any public records, KEV entries, CERT advisories, or vendor reports attributing exploitation to named groups. This assessment carries medium confidence given the recency of the disclosure.

What To Do

Organizations running Apache IoTDB should apply the vendor-supplied patch as soon as it becomes available, prioritizing internet-exposed or network-accessible IoTDB REST endpoints given the critical CVSS score of 9.8. As an interim workaround, restrict access to the IoTDB REST API using network-level controls such as firewall rules or API gateways, and enforce short credential rotation cycles to reduce the window of exposure for any captured credentials. Operators should also review authentication logs for anomalous or repeated REST API authentication attempts from unexpected source addresses, which may indicate replay attempts. Monitor the Apache IoTDB security advisories page for patch availability and version-specific guidance.