CVE-2025-13426

published 2025-12-05

CVE-2025-13426: A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote…

Priority P2 64 high 8.7 CVSS 4.0

AV N AC L AT N PR L UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U Clear

A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution.

It is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute arbitrary Java code and system commands at runtime, leading to unauthorized access to data, lateral movement within the network, and access to backend systems.

The Apigee hybrid versions below have all been updated to protect from this vulnerability:
* Hybrid_1.11.2+
* Hybrid_1.12.4+
* Hybrid_1.13.3+
* Hybrid_1.14.1+
* OPDK_5202+
* OPDK_5300+

Affected

6 ranges

Vendor	Product	Version range	Fixed in
google_cloud	apigee_hybrid_javacallout_policy	< Hybrid_1.11.2	Hybrid_1.11.2
google_cloud	apigee_hybrid_javacallout_policy	< Hybrid_1.12.4	Hybrid_1.12.4
google_cloud	apigee_hybrid_javacallout_policy	< Hybrid_1.13.3	Hybrid_1.13.3
google_cloud	apigee_hybrid_javacallout_policy	< Hybrid_1.14.1	Hybrid_1.14.1
google_cloud	apigee_hybrid_javacallout_policy	< OPDK_5202	OPDK_5202
google_cloud	apigee_hybrid_javacallout_policy	< OPDK_5300	OPDK_5300

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-913