{
  "cveId": "CVE-2026-13006",
  "url": "https://patchblox.com/security/cve/CVE-2026-13006",
  "summary": "CVE-2026-13006 is fixed in logback on 1 platform by DEBIAN-CVE-2026-13006 (version 1:1.6.3-1), released June 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "logback: ACE vulnerability in conditional configuration file processing  by QOS.CH logback-core up to and including version 1....",
  "description": "ACE vulnerability in conditional configuration file processing  by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing existing protections against CVE-2025-11226 by\u00A0compromising an existing logback configuration file or by injecting an environment variable before program execution.    A successful attack requires the presence of Janino library to be present on the user\u0027s class path. In addition, the attacker must\u00A0 have write access to a  configuration file. Alternatively, the attacker could inject a malicious  environment variable pointing to a malicious configuration file. In both  cases, the attack requires existing privilege.  Please note that in logack version 1.5.37 conditional processing using Janino was removed.",
  "published": "2026-06-24T07:16:27Z",
  "severity": "",
  "epss": 0.00175,
  "epssPercentile": 0.07061,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "logback",
      "release": "Debian 14",
      "fixedVersion": "1:1.6.3-1",
      "fix": "DEBIAN-CVE-2026-13006",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-13006",
      "released": "2026-06-24T07:16:27Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}