CVE-2022-24816: JAI-EXT Jiffle script code injection enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 10.0, CISA KEV listing with a past due date, and near-maximum EPSS indicate active, high-impact exploitation.

What it is

JAI-EXT compiles Jiffle scripts into Java code via Janino and executes them. When an application such as GeoServer accepts Jiffle scripts from network requests, an attacker can inject code that runs as Java, leading to remote code execution. The flaw is rated CVSS 10.0 and is listed in CISA KEV, so it warrants urgent attention.

Impact

An unauthenticated attacker can execute arbitrary code in the context of the affected server, giving full control over the host and any data or services it can reach.

Attack surface

Reached over the network by submitting a crafted Jiffle script to an endpoint that compiles it, as in downstream GeoServer deployments. The CVSS vector shows no privileges or user interaction required.

Exploitation

CVE-2022-24816 is in CISA KEV with a 2024-06-26 addition and a 2024-07-17 remediation due date, and EPSS gives a 30-day probability of 0.98518 (99.9th percentile), indicating active exploitation. No ransomware campaign use is documented.

What to do

• Upgrade JAI-EXT to version 1.2.22 or later, which disables injection into the compiled script.
• If upgrade is not possible, remove janino-x.y.z.jar from the classpath to prevent Jiffle script compilation.
• Restrict or disable network endpoints that accept Jiffle scripts until patched.
• Apply the vendor advisory guidance and CISA KEV required actions, discontinuing use if mitigations are unavailable.

Detection

• Monitor for requests containing Jiffle script content sent to GeoServer or other JAI-EXT endpoints.
• Alert on unexpected Java compilation or Janino activity and on child processes spawned by the application server.
• Review application and web server logs for anomalous script submissions or errors from Jiffle compilation.
• Hunt for outbound connections or new files created by the Java process hosting JAI-EXT.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.