# Collibra Platform Agent has chained vulnerabilities (CVE-2026-10622, CVE-2026-10621)…

Published: 2026-06-02 · Severity: critical
Canonical: https://vorant.io/reports/876410cc-9560-4c44-aa18-2f6d17c3c8d2/collibra-platform-agent-has-chained-vulnerabilities-cve-2026-10622-cve-2026

> Collibra Platform Agent has chained vulnerabilities (CVE-2026-10622, CVE-2026-10621) allowing unauthenticated remote code execution via authentication bypass and Zip Slip attack.

The Collibra Platform Agent, used in both cloud-based and self-hosted deployments, contains two critical vulnerabilities that can be chained by unauthenticated attackers to achieve remote code execution. CVE-2026-10622 is an authentication bypass affecting privileged REST endpoints under /rest/*, allowing attackers to access sensitive functionality without credentials. The vulnerable service also binds to all network interfaces regardless of configuration, potentially exposing it beyond intended trust boundaries.

CVE-2026-10621 is a Zip Slip path traversal vulnerability in the POST /rest/restore endpoint that fails to validate file paths during ZIP archive extraction. Attackers can craft malicious archives containing directory traversal sequences to write files to arbitrary locations on the host filesystem. The observed exploitation chain involves uploading a weaponized JSP file to a web-accessible directory, then triggering code execution by requesting the file over HTTP.

Successful exploitation grants attackers full control over the affected system, enabling persistent web shell installation, data manipulation, service disruption, and potential lateral movement. Because no authentication is required and the service may be internet-exposed, organizations running vulnerable versions face immediate risk. Collibra has released patches for both SaaS (2026.05, 2026.04.5, 2026.03.4, 2026.02.6, 2025.11.7, 2025.10.9) and self-hosted (2026.03 build 356, 2025.10 build 399) deployments.

## Mentioned in this report

- Vulnerabilities: CVE-2026-10621, CVE-2026-10622

## Detection guidance (public sample)

### JSP Web Shell Dropped by Collibra Java Process into Web-Accessible Directory

ATT&CK: T1505.003

Detects creation of a .jsp file by the Collibra/Tomcat java process in a web-accessible directory, consistent with the Zip Slip path traversal exploitation used to plant a web shell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: JSP File Written by Java Process in Web Directory
id: 3ae56c3e-70da-593c-a1dc-48da8fbdf8e9
status: experimental
description: Detects a .jsp file being written to disk by a java.exe/java process
  (typically the Collibra/Tomcat service account) into a webapps or web-accessible
  directory, indicating possible web shell installation following Zip Slip exploitation
  of the /rest/restore endpoint.
references:
- Internal report on CVE-2026-10621 / CVE-2026-10622 Collibra Platform Agent chained
  RCE
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|contains:
    - java.exe
    - java
    TargetFilename|endswith: .jsp
    TargetFilename|contains:
    - webapps
    - ROOT
  filter:
    TargetFilename|contains:
    - \work\
    - \temp\jsp-precompile\
  condition: selection and not filter
falsepositives:
- Legitimate JSP deployment via application server hot-deploy or CI/CD pipelines
- Normal JSP precompilation artifacts generated by Tomcat during startup
level: high
tags:
- attack.t1505.003
- attack.t1190
author: Vorant
```

### Shell Process Spawned from Java Web Application Process (Possible Web Shell Execution)

ATT&CK: T1059.007

Detects a command interpreter or scripting engine being spawned as a child of the java process running the Collibra/Tomcat service, indicating possible web shell command execution after JSP payload upload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Command Shell Spawned from Java Process (Web Shell Indicator)
id: 6541a445-60b0-5d77-b78f-70797bd17211
status: experimental
description: Detects cmd.exe, powershell.exe, or /bin/sh being spawned as a direct
  child of a java process (Collibra/Tomcat), which is consistent with execution of
  an uploaded JSP web shell that shells out to run attacker commands after CVE-2026-10621/CVE-2026-10622
  exploitation.
references:
- Internal report on CVE-2026-10621 / CVE-2026-10622 Collibra Platform Agent chained
  RCE
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains: java
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \sh
    - \bash
  filter:
    CommandLine|contains:
    - catalina
    - startup.bat
  condition: selection and not filter
falsepositives:
- Legitimate administrative scripts or health checks invoked by the application server
- Custom Collibra plugins that intentionally shell out for approved automation tasks
level: high
tags:
- attack.t1059.007
- attack.t1505.003
- attack.t1190
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/873170

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/876410cc-9560-4c44-aa18-2f6d17c3c8d2/collibra-platform-agent-has-chained-vulnerabilities-cve-2026-10622-cve-2026.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup