Floci VtlTemplateEngine Flaw Lets Attackers Run Code Without Login
Unauthenticated users can execute OS commands in Floci versions below 2.2.0 via malicious Velocity templates, posing critical risk to infrastructure.
Key points
- The vulnerability affects Floci versions 1.1.0 through those prior to 2.2.0.
- It carries a CVSS score of 9.3, classified as critical by the National Vulnerability Database.
- No authentication is required for an attacker to exploit this code injection flaw.
An unpatched flaw in the Floci API management platform allows attackers to execute operating system commands without needing valid credentials. The issue, identified as CVE-2026-108598, resides in the VtlTemplateEngine component. Security researchers note that this critical vulnerability enables remote code execution, giving adversaries full control over the underlying Java Virtual Machine hosting the application.
In plain English
The VtlTemplateEngine processes Velocity mapping templates used within Floci integrations. According to the National Vulnerability Database, attackers can craft a REST API with a MOCK integration that contains malicious template code. This code uses reflection techniques to access Java Runtime or ProcessBuilder objects, effectively bypassing security restrictions and running arbitrary system commands on the server.
The background
The National Vulnerability Database lists CVE-2026-108598 as a code injection weakness, mapped to CWE-94. The flaw impacts Floci versions starting from 1.1.0 and extending to any release before 2.2.0. Because the vulnerability is unauthenticated, any user with network access to the Floci instance can attempt exploitation, significantly widening the attack surface for potential breaches.
What changes now
Organizations running affected Floci versions face immediate risk of complete system compromise. The lack of authentication requirements means automated scanning tools can easily identify and exploit the weakness. Until administrators apply the vendor-provided update to version 2.2.0 or later, the Floci JVM remains vulnerable to remote command execution via manipulated Velocity templates.
What to do and how to stay safe: Floci
- Inventory all Floci installations to identify versions 1.1.0 through those prior to 2.2.0.
- Isolate affected Floci instances from untrusted networks until a patch can be applied.
- Monitor system logs for unusual command executions or unexpected process spawns in the JVM.
- Review API configurations for any MOCK integrations that accept user-supplied template input.
Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Floci versions are affected by CVE-2026-108598?
Floci versions 1.1.0 through those prior to 2.2.0 are vulnerable to this code injection flaw.
Do attackers need login credentials to exploit this vulnerability?
No, the National Vulnerability Database states that attackers can execute commands without authentication.
What is the severity rating for CVE-2026-108598?
The vulnerability has a CVSS score of 9.3 and is classified as critical.
