External risk intelligence

AntFlow V2.0.0 JUEL Expression Command Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-75414

AntFlow is a workflow management system typically deployed as a web application. Such applications are commonly exposed to the internet or accessible via corporate networks to facilitate user interaction, making the underlying command execution vulnerability reachable through standard web-based deployment patterns.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in AntFlow V2.0.0 that could allow unauthorized command execution. The issue stems from improper handling of user input within a testing component, potentially enabling attackers to run commands on affected systems without requiring user interaction or special privileges. Given its critical severity and network accessibility, understanding the relevance of AntFlow within our environment is important.

Allows unauthorized command execution.
Critical flaw could affect systems without interaction.
Confirm AntFlow relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a command execution vulnerability in AntFlow by sending specially crafted input that is processed by the ActivitiTest.java component. This component does not properly filter user-supplied data before evaluating it as a JUEL expression, allowing an attacker to inject malicious commands that are then executed on the server. This could lead to the attacker gaining control over the system.

No special access needed.
User input triggers command execution.
Server compromise and data theft.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary commands on the server by submitting specially crafted input to the AntFlow application. This could affect the integrity and availability of the system.

Server-side command execution.
Unfiltered user input execution.
System compromise and data loss.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in AntFlow, enabling command execution through unfiltered user input in ActivitiTest.java, likely impacts teams responsible for application security and infrastructure. The first practical step is to identify all AntFlow deployments, determine their reachability and business criticality, and pinpoint the accountable application owner to plan remediation.

Application owners and security teams.
Verify AntFlow exposure and business criticality.
Plan coordinated remediation and vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AntFlow?

AntFlow is a workflow management system designed to streamline business processes. It functions as a web-based application, which typically allows teams to automate tasks and organize data flow within an organization's internal or public-facing digital infrastructure.

What does CVE-2026-75414 mean?

This vulnerability is classified as CWE-94, which involves the improper control of code generation. In this case, the application fails to filter user input before processing it as a JUEL expression. This allows the system to inadvertently execute commands supplied by a user, effectively treating external data as instructions to be run on the host server.

How is this command execution triggered?

An attacker triggers this by sending specially crafted input to the ActivitiTest.java component within the application. Because the component processes this data without validation, the server executes the injected commands. The vulnerability is not triggered by standard, legitimate usage; it requires the submission of malicious, non-standard input designed to exploit the expression language evaluation.

Is my system at risk?

According to Halo Surface Signal, this risk is likely for most deployments because AntFlow is typically used as a web application. If your instance is reachable over the internet or through a broad corporate network, it is accessible to unauthorized actors. Systems that are isolated from network traffic face a lower probability of immediate exploitation, but internal reachability remains a factor.

How should I respond to this vulnerability?

Begin by creating an inventory of all AntFlow deployments in your environment. Once identified, work with the designated application owners to assess the reachability of each instance and determine its business criticality. Use this information to prioritize which systems need immediate attention and coordinate with the vendor to address the flaw in your specific deployment.

References

github.com/Y4y17/CVE/blob/main/AntFlow/Front%20desk%20command%20…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.