Apache Solr UNC Path Validation Vulnerability (CVE-2026-22444)

CVE-2026-22444 is a critical vulnerability affecting Apache Solr versions prior to 9.10.1. The flaw resides in the 'create core' API, specifically within the CoreContainer.java component, where the application fails to perform adequate input validation on UNC paths provided in API parameters. When Apache Solr is running in standalone mode, an attacker who can interact with the create core API - either through an unauthenticated endpoint or by leveraging low-privileged credentials - can inject a malicious UNC path. This action triggers an immediate network operation to resolve the path before the application validates the input. Exploitation of this flaw can result in the leakage of NTLM hashes through NTLM authentication relay, unauthorized access to sensitive files, or remote code execution under the context of the Solr service account.

Impact

Successful exploitation allows for the compromise of the host running the Solr instance, data exfiltration of sensitive configuration files, and lateral movement within the network via captured NTLM credentials. Organizations utilizing Apache Solr in standalone mode with create core API access enabled are at highest risk.

Recommendation

Prioritized actions for security and infrastructure teams:

• Upgrade all Apache Solr instances to version 9.10.1 or later to implement proper UNC path validation.
• Audit access to the Solr create core API; restrict access to authorized management IPs only.
• Monitor web server logs for suspicious POST requests to the 'create core' API containing UNC path patterns (e.g., \server\share).
• Review network egress telemetry for unusual SMB or NTLM authentication traffic originating from Apache Solr servers.