PatchTheCVECVE-2016-15057: ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Inject
CVE-2016-15057 is a critical-severity flaw (CVSS 9.9) affecting continuum. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum. This issue affects Apache Continuum: all versions. Attackers with access to the installations REST API can use this to invoke arbitrary commands on the server. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or r
Why this priority
- Critical severity
- EPSS top 10%: very likely to be exploited
- Public exploit reference
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.9 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 3.9% (top 10%) |
| CISA exploited list | No |
| Weakness | CWE-77 |
| Published | 2026-01-26 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Metasploit: Apache Continuum Arbitrary Command Execution
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2016-15057?
continuum: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2016-15057 being exploited?
CVE-2016-15057 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2016-15057 affect?
CVE-2016-15057 affects continuum. Severity is critical (CVSS 9.9). ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum. This issue affects Apache Continuum: all versions. Attackers with access to the install
How urgent is CVE-2016-15057?
Priority 67/100. Critical severity; EPSS top 10%: very likely to be exploited; Public exploit reference; On your watchlist