Is CVE-2018-8088 being actively exploited?

CVE-2018-8088 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2018-8088?

CVE-2018-8088 has a CVSS 3.1 base score of 9.8 (CRITICAL).

CVE-2018-8088

CRITICAL · CVSS 9.8EPSS 14.7%EU EUVD

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.

Key facts

CVSS score: 9.8 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS score: 14.7% (97th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2022-5518)
Published: March 20, 2018
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2022-5518 in the EU Vulnerability Database. Last updated in EUVD on August 5, 2024.

View on the EU Vulnerability Database

Affected products

oracle / goldengate application adapters
oracle / goldengate stream analytics
oracle / utilities framework
oracle / utilities framework
oracle / utilities framework
oracle / utilities framework
oracle / utilities framework
oracle / utilities framework
oracle / utilities framework
oracle / utilities framework
qos / slf4j
qos / slf4j
qos / slf4j
qos / slf4j
qos / slf4j
redhat / enterprise linux
redhat / enterprise linux
redhat / enterprise linux
redhat / enterprise linux desktop
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux server
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server tus
redhat / enterprise linux server tus
redhat / enterprise linux server tus
redhat / enterprise linux workstation
redhat / jboss enterprise application platform
redhat / jboss enterprise application platform
redhat / jboss enterprise application platform
redhat / virtualization
redhat / virtualization host

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

Red Hat Enterprise Linux 7.6 - Red Hat, Inc. - Common Criteria CCEVS-VR-VID-11039-2020 - archived

References

http://www.securityfocus.com/bid/103737(Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id/1040627(Third Party Advisory, VDB Entry)
https://access.redhat.com/errata/RHSA-2018:0582(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:0592(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:0627(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:0628(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:0629(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:0630(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1247(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1248(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1249(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1251(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1323(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1447(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1448(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1449(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1450(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1451(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1525(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1575(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:2143(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:2419(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:2420(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:2669(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:2930(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2019:2413(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2019:3140(Third Party Advisory)
https://github.com/qos-ch/slf4j/commit/d2b27fba88e983f921558da27fc29b5f5d269405(Patch, Third Party Advisory)
https://jira.qos.ch/browse/SLF4J-430(Issue Tracking, Vendor Advisory)
https://jira.qos.ch/browse/SLF4J-431(Issue Tracking, Vendor Advisory)
https://lists.apache.org/thread.html/956ba8e76b6793a6670b2eb0129a5e3003ce2124ca3130fd57d48d0f%40%3Cdevnull.infra.apache.org%3E
https://lists.apache.org/thread.html/95ce76613c869dbccf1d3d29327099ccc71aeec156f76c30853044fa%40%3Cdevnull.infra.apache.org%3E
https://lists.apache.org/thread.html/r0f376559fd39cf1a53ac3afbc1fc5d62649dcac9916d4697445a94fa%40%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r1660c72a660f0522947ca6ce329dcc74e1ee20c58bbe208472754489%40%3Ccommon-issues.hadoop.apache.org%3E
https://lists.apache.org/thread.html/r17e7e6abc53d29c0e269153517d36f4bec2755b95900596e6df15cbe%40%3Cnotifications.iotdb.apache.org%3E
https://lists.apache.org/thread.html/r2d05924f903403927a2f4e78d9b1249a42f0bd09f69a7c1954d74a42%40%3Creviews.iotdb.apache.org%3E
https://lists.apache.org/thread.html/r32be21da011479df41468a62bc09d12f0d3b4e3a71679d33cb0e8c56%40%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r37644f0a00aca9fbcbc21c0f9a91f927b63153ec3607be469cd515e5%40%3Creviews.iotdb.apache.org%3E
https://lists.apache.org/thread.html/r48247c12cf652e95a01fc94ee5aa8641f3ec481235774790e53eb55e%40%3Creviews.iotdb.apache.org%3E
https://lists.apache.org/thread.html/r573eb577a67503e72181eee637d9b0ac042197e632bcdfce76af06a3%40%3Cissues.flink.apache.org%3E

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain