Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

Summary

PrimeFaces, a Java component library used for building web application interfaces, is affected by this flaw. An attacker could exploit the weak encryption to run arbitrary code remotely on the affected server.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Timeline

1. Jan 3, 2018, 8:00 PM UTCCVE published
2. Jan 10, 2022Added to CISA KEV

   CISA has evidence of exploitation in the wild

3. Jul 10, 2022CISA remediation deadline

   Due date for US federal agencies to patch

4. Oct 21, 2025, 11:45 PM UTCRecord last updated
5. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• org.primefaces:primefacesMaven

  From 5.0 · fixed in 6.0

References 4