PatchTheCEVeclipse vulnerabilities
Recent CVEs affecting eclipse products. 13 tracked.
eclipse has 13 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 13. Most recent: 2026-08-06. Highest priority: CVE-2026-12609 (score 50/100).
- CVE-2026-61387 HIGH 7.5 UPGRADE In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item c
- CVE-2026-63252 HIGH 7.5 UPGRADE In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial
- CVE-2026-60007 HIGH 7.4 UPGRADE In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for inv
- CVE-2026-58080 HIGH 8.2 UPGRADE In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleM
- CVE-2026-62927 HIGH 7.5 UPGRADE In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-
- CVE-2026-63248 MEDIUM 6.5 UPGRADE In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorizat
- CVE-2026-12609 HIGH 7.5 UPGRADE In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/
- CVE-2026-46581 HIGH 7.5 UPGRADE In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly saniti
- CVE-2026-12605 CRITICAL 9.6 UPGRADE In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admi
- CVE-2026-60009 HIGH 8.8 UPGRADE In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload
- CVE-2026-61891 HIGH 7.5 UPGRADE In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-downlo
- CVE-2026-14574 MEDIUM 6.5 UPGRADE In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia
- CVE-2026-14304 MEDIUM 5.5 UPGRADE UPGRADE In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20
FAQ
How do I fix eclipse vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is eclipse being exploited right now?
None of the tracked eclipse CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which eclipse CVE should I patch first?
CVE-2026-12609 currently ranks highest (50/100): In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/.