PatchTheCVECVE-2021-41269: cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descripti
CVE-2021-41269 is a critical-severity flaw (CVSS 10.0) affecting cron-utils. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected versions A template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to val
Why this priority
- Critical severity
- EPSS top 9%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 10.0 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 4.3% (top 9%) |
| CISA exploited list | No |
| Weakness | CWE-94 |
| Published | 2021-11-15 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-41269?
cron-utils: upgrade to 9.1.6. Exact commands for each OS are on this page.
Is CVE-2021-41269 being exploited?
CVE-2021-41269 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-41269 affect?
CVE-2021-41269 affects cron-utils. Severity is critical (CVSS 10.0). cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected versions A template Injection was identified in cron-utils enabling attackers to inject arbitrary Java E
How urgent is CVE-2021-41269?
Priority 68/100. Critical severity; EPSS top 9%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2020-26238 HIGH 7.9 UPGRADE Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for