topic CVE-2025-24814 Solr Vulnerability in Alfresco Forum

CVE-2025-24814 Solr Vulnerability

bharath — Mon, 09 Feb 2026 07:53:08 GMT

Hi Community,

Has Hyland or the Alfresco community reviewed whether Alfresco Search Service is vulnerable to Solr CVE-2025-24814, particularly for Alfresco Search Service 2.0.x?

If there are any findings, advisories, or recommended mitigations, could you please share them or point to the relevant references?

https://nvd.nist.gov/vuln/detail/CVE-2025-24814

Re: CVE-2025-24814 Solr Vulnerability

angelborroy — Tue, 10 Feb 2026 06:58:29 GMT

Following the documented installation practices for Alfresco Search Services mitigates CVE-2025-24814 because the vulnerability only applies to unauthenticated Apache Solr deployments.

Alfresco Search Services runs Apache Solr in a secured mode by default, with authentication and encrypted communication enabled between the repository and Solr. This prevents unauthenticated access to Solr admin APIs and the filesystem-based configset mechanism that CVE-2025-24814 relies on.

In that context, the CVE has been classified as a false positive for Alfresco deployments that follow recommended practices.

Re: CVE-2025-24814 Solr Vulnerability

bharath — Wed, 11 Feb 2026 03:21:57 GMT

Thank you for sharing the solution. I truly appreciate your guidance and support.