Security readout for executives and security teams
Plain-English summary
CVE-2021-40089 affects PrimeKey EJBCA before 7.6.0. A setting meant to disable external script access did not stop already-created General Purpose Custom Publishers from running local scripts. For organizations using EJBCA as certificate authority infrastructure, this matters because disabled policy controls may not have enforced expected operational boundaries.
Executive priority
Prioritize review if EJBCA protects business-critical certificate authority operations. The issue is not reported as exploited, but it undermines an administrative safety control around local script execution.
Technical view
In EJBCA before 7.6.0, disabling Enable External Script Access prevented creation of new General Purpose Custom Publishers, but existing publishers continued executing during publishing operations. The issue is a configuration enforcement gap around local script invocation. No CVSS, CWE, or affected CPE detail is provided in the source bundle.
Likely exposure
Exposure is limited to EJBCA deployments before 7.6.0 that had existing General Purpose Custom Publisher configurations. Risk depends on what local scripts those publishers run, their privileges, and whether administrators relied on the disabled external script setting as a control.
Exploitation context
The provided sources do not report active exploitation, public exploit code, or KEV listing. The issue appears configuration-dependent and requires an existing publisher capable of invoking local scripts.
Researcher notes
Key evidence is narrow: the CVE description and PrimeKey reference state the broken behavior and fixed version boundary, but provide no CVSS, CWE, exploitability details, or complete affected-version matrix. Treat risk assessment as environment-specific.
Mitigation direction
- Upgrade PrimeKey EJBCA to 7.6.0 or later where applicable.
- Review vendor advisory for deployment-specific remediation guidance.
- Inventory existing General Purpose Custom Publishers.
- Disable or remove publishers that are no longer explicitly required.
- Review operational controls around local scripts invoked by EJBCA.
Validation and detection
- Confirm the deployed EJBCA version is before or after 7.6.0.
- Check whether General Purpose Custom Publishers exist in the deployment.
- Verify the Enable External Script Access setting state.
- Review publisher activity logs for unexpected script execution.
- After remediation, confirm disabled external script access blocks legacy publisher execution.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-40089 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://support.primekey.com/news/posts/54CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.