CVE-2026-77615

HIGHPre-NVD 8.78.7—
EchelonGraph scoreMEDIUM confidence

This high-severity CVE scores 8.7 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit probability: 0.6%, top 56% of all CVEs by exploit prediction. GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).

Triggered by: NVD CVSS baseline
Sources: epss, secondary
Elevated
8.7EG
EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.
  • High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS PROB: 1%CVSS: 8.7Exploit: Elevated riskExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 (as used in Opencast prior to 19.7 and 20.2), there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11.

CVSS v3
8.7
EG Score
8.7(medium)
EG Risk
55(Track*)
EG Risk 55/100SSVC: Track*

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed
Severity87% × 45%
Exploitation40% × 40%
Automatability0% × 15%
Action: Watch closely — could escalate to Attend.
EPSS PROB
1%
EPSS %ILE
44%
KEV
Not listed

Published

September 17, 2026

Last Modified

September 24, 2026

Advisory Details (9)

Auto-updated Sep 17, 2026
Patch available. Sources: github_pr, github_commit, github_release, github.
generic

paella-player/repos/paella-core/CHANGELOG.md at a1b6c42467938a00a4b4d0b8c68435cd4f9d2a16 · polimediaupv/paella-player · GitHub

https://github.com/polimediaupv/paella-player/blob/a1b6c42467938a00a4b4d0b8c68435cd4f9d2a16/repos/paella-core/CHANGELOG.md?plain=1#L21
github_release Patch Available

Opencast 20.2

Patch available: opencast/opencast 20.2

https://github.com/opencast/opencast/releases/tag/20.2
github_release Patch Available

Opencast 19.7

Patch available: opencast/opencast 19.7

https://github.com/opencast/opencast/releases/tag/19.7
github_commit

commit 6fe4af730604 (polimediaupv/paella-player)

Fix landed in polimediaupv/paella-player commit 6fe4af730604 — awaiting tagged release

https://github.com/polimediaupv/paella-player/commit/6fe4af7306044198c8e91e2e7f4128428b83cf03
github_commit

commit 9b2f14ec4cf5 (polimediaupv/paella-core)

Fix landed in polimediaupv/paella-core commit 9b2f14ec4cf5 — awaiting tagged release

https://github.com/polimediaupv/paella-core/commit/9b2f14ec4cf55efaf4c045c77a5ed8f5ec559ab4
github_commit

commit 94a36490808a (polimediaupv/paella-core)

Fix landed in polimediaupv/paella-core commit 94a36490808a — awaiting tagged release

https://github.com/polimediaupv/paella-core/commit/94a36490808ac5a1f60a0745d71ec9253f6d206b
github_commit

commit 701682c635f6 (opencast/opencast)

Fix landed in opencast/opencast commit 701682c635f6 — awaiting tagged release

https://github.com/opencast/opencast/commit/701682c635f668228c3e8fb7b4564b3294788e40
github_pr

Upgrade paella 8

Fix merged in opencast/opencast PR #7736 on 2026-07-14 — awaiting tagged release

https://github.com/opencast/opencast/pull/7736
github Patch Available

Stored XSS in Paella player via WebVTT/DFXP caption cue text · Advisory · opencast/opencast · GitHub

https://github.com/opencast/opencast/security/advisories/GHSA-m6c8-jcw2-5r25

Vendor Advisories for CVE-2026-77615(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Affected Packages

(2 across 2 ecosystems)
Maven(1)
PackageVulnerable rangeFixed inDependents
org.opencastproject:opencast-engage-paella-player-712.0 ... 18.5 (61 versions)19.7—
npm(1)
PackageVulnerable rangeFixed inDependents
paella-core—1.50.6—

Weakness Classification(1)

MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.

Data Freshness Timeline

(refreshed 17× in last 7d / 20× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-09-24 19:00 UTCEG score recompute
  2. 2026-09-24 14:04 UTCEPSS rescore
  3. 2026-09-24 06:06 UTCEG score recompute
  4. 2026-09-23 17:54 UTCEPSS rescore
  5. 2026-09-23 04:17 UTCEG score recompute
  6. 2026-09-22 16:01 UTCEPSS rescore
  7. 2026-09-22 15:23 UTCEG score recompute
  8. 2026-09-22 02:29 UTCEG score recompute
  9. 2026-09-22 01:56 UTCEG score recompute
  10. 2026-09-21 21:09 UTCEPSS rescore
  11. 2026-09-21 05:51 UTCEG score recompute
  12. 2026-09-20 20:16 UTCEPSS rescore
  13. 2026-09-20 04:03 UTCEG score recompute
  14. 2026-09-19 02:15 UTCEG score recompute
  15. 2026-09-18 19:28 UTCEPSS rescore
  16. 2026-09-18 13:22 UTCEG score recompute
  17. 2026-09-18 13:14 UTCEG score recompute
  18. 2026-09-17 21:20 UTCEG score recompute
  19. 2026-09-17 20:54 UTCEG score recompute
  20. 2026-09-17 20:54 UTCMITRE cvelistV5first tracked

Related CVEs(same CWE)

Frequently asked(5)

What is CVE-2026-77615?
CVE-2026-77615 is a high vulnerability published on September 17, 2026. Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 (as used in Opencast prior to 19.7 and 20.2), there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11.
When was CVE-2026-77615 disclosed?
CVE-2026-77615 was first published in the National Vulnerability Database on September 17, 2026, with the most recent update on September 24, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-77615 actively exploited?
CVE-2026-77615 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 1% probability of exploitation in the next 30 days, which ranks it in the top 55.9% of all scored CVEs.
What is the CVSS score of CVE-2026-77615?
CVE-2026-77615 has a CVSS v3 base score of 8.7 (NVD).
How do I remediate CVE-2026-77615?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-77615, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-77615

Explore →

Is Your Infrastructure Affected by CVE-2026-77615?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Book a Demo →Browse All CVEs