Collibra Platform Agent has chained vulnerabilities (CVE-2026-10622, CVE-2026-10621)…
Collibra Platform Agent has chained vulnerabilities (CVE-2026-10622, CVE-2026-10621) allowing unauthenticated remote code execution via authentication bypass and Zip Slip attack.
The Collibra Platform Agent, used in both cloud-based and self-hosted deployments, contains two critical vulnerabilities that can be chained by unauthenticated attackers to achieve remote code execution. CVE-2026-10622 is an authentication bypass affecting privileged REST endpoints under /rest/*, allowing attackers to access sensitive functionality without credentials. The vulnerable service also binds to all network interfaces regardless of configuration, potentially exposing it beyond intended trust boundaries.
CVE-2026-10621 is a Zip Slip path traversal vulnerability in the POST /rest/restore endpoint that fails to validate file paths during ZIP archive extraction. Attackers can craft malicious archives containing directory traversal sequences to write files to arbitrary locations on the host filesystem. The observed exploitation chain involves uploading a weaponized JSP file to a web-accessible directory, then triggering code execution by requesting the file over HTTP.
Successful exploitation grants attackers full control over the affected system, enabling persistent web shell installation, data manipulation, service disruption, and potential lateral movement. Because no authentication is required and the service may be internet-exposed, organizations running vulnerable versions face immediate risk. Collibra has released patches for both SaaS (2026.05, 2026.04.5, 2026.03.4, 2026.02.6, 2025.11.7, 2025.10.9) and self-hosted (2026.03 build 356, 2025.10 build 399) deployments.
Mentioned in this report
Detection guidance
JSP Web Shell Dropped by Collibra Java Process into Web-Accessible Directory
Detects creation of a .jsp file by the Collibra/Tomcat java process in a web-accessible directory, consistent with the Zip Slip path traversal exploitation used to plant a web shell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: JSP File Written by Java Process in Web Directory
id: 3ae56c3e-70da-593c-a1dc-48da8fbdf8e9
status: experimental
description: Detects a .jsp file being written to disk by a java.exe/java process
(typically the Collibra/Tomcat service account) into a webapps or web-accessible
directory, indicating possible web shell installation following Zip Slip exploitation
of the /rest/restore endpoint.
references:
- Internal report on CVE-2026-10621 / CVE-2026-10622 Collibra Platform Agent chained
RCE
logsource:
category: file_event
product: windows
detection:
selection:
Image|contains:
- java.exe
- java
TargetFilename|endswith: .jsp
TargetFilename|contains:
- webapps
- ROOT
filter:
TargetFilename|contains:
- \work\
- \temp\jsp-precompile\
condition: selection and not filter
falsepositives:
- Legitimate JSP deployment via application server hot-deploy or CI/CD pipelines
- Normal JSP precompilation artifacts generated by Tomcat during startup
level: high
tags:
- attack.t1505.003
- attack.t1190
author: Vorant
Shell Process Spawned from Java Web Application Process (Possible Web Shell Execution)
Detects a command interpreter or scripting engine being spawned as a child of the java process running the Collibra/Tomcat service, indicating possible web shell command execution after JSP payload upload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Command Shell Spawned from Java Process (Web Shell Indicator)
id: 6541a445-60b0-5d77-b78f-70797bd17211
status: experimental
description: Detects cmd.exe, powershell.exe, or /bin/sh being spawned as a direct
child of a java process (Collibra/Tomcat), which is consistent with execution of
an uploaded JSP web shell that shells out to run attacker commands after CVE-2026-10621/CVE-2026-10622
exploitation.
references:
- Internal report on CVE-2026-10621 / CVE-2026-10622 Collibra Platform Agent chained
RCE
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains: java
Image|endswith:
- \cmd.exe
- \powershell.exe
- \sh
- \bash
filter:
CommandLine|contains:
- catalina
- startup.bat
condition: selection and not filter
falsepositives:
- Legitimate administrative scripts or health checks invoked by the application server
- Custom Collibra plugins that intentionally shell out for approved automation tasks
level: high
tags:
- attack.t1059.007
- attack.t1505.003
- attack.t1190
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/873170
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free