CVE-2026-22444 is a security vulnerability affecting Apache Solr versions 8.6 through 9.10.0, stemming from improper input validation (CWE-20) in the 'create core' API. Solr's 'allowPaths' setting is designed to restrict filesystem access to specific directories, preventing unauthorized reading of files. However, due to insufficient validation of API parameters, attackers can manipulate the 'create core' API to cause Solr to check and read filesystem paths outside the allowed directories. This can result in the creation of Solr cores using unexpected configuration sets accessible on the filesystem, potentially exposing sensitive data or configurations. On Windows systems configured to allow UNC paths, this vulnerability can lead to the disclosure of NTLM user hashes, which attackers could use for credential theft or lateral movement. The vulnerability is exploitable only if Solr is running in standalone mode, the 'allowPath' restriction is in place, and the 'create core' API is exposed to untrusted users—often due to disabled or misconfigured RuleBasedAuthorizationPlugin permissions. No known exploits are currently reported in the wild. The Apache Software Foundation has addressed this issue in Solr version 9.10.1 and later, recommending users to upgrade and properly configure authorization controls to prevent unauthorized core creation.

For European organizations, this vulnerability poses significant risks including unauthorized access to sensitive filesystem data and potential exposure of NTLM hashes on Windows-based Solr deployments. This can lead to data confidentiality breaches, unauthorized configuration changes, and facilitate lateral movement within corporate networks. Organizations relying on Solr for search and indexing services, especially those exposing the 'create core' API without strict access controls, may face operational disruptions and increased risk of compromise. The exposure of NTLM hashes is particularly concerning in environments where Windows authentication is prevalent, as it can enable attackers to escalate privileges or move laterally. Given the widespread use of Apache Solr in enterprise search applications across Europe, the vulnerability could impact sectors such as finance, government, healthcare, and telecommunications, where sensitive data is indexed and searched. Failure to mitigate this vulnerability could also affect compliance with European data protection regulations like GDPR due to potential unauthorized data access.

European organizations should immediately verify if their Apache Solr deployments are running versions 8.6 through 9.10.0 and assess whether the 'create core' API is exposed to untrusted users. They must enable and properly configure the RuleBasedAuthorizationPlugin to restrict 'core-admin-edit' or equivalent permissions exclusively to trusted administrative roles, preventing unauthorized core creation. Upgrading to Apache Solr version 9.10.1 or later is critical to apply the official fix. Additionally, organizations should audit their 'allowPaths' settings to ensure they are correctly restricting filesystem access and review network exposure of Solr APIs, ideally limiting access via firewall rules or VPNs. On Windows systems, disabling UNC path support where not required or applying additional network segmentation can reduce the risk of NTLM hash exposure. Regular monitoring and logging of Solr API usage should be implemented to detect anomalous core creation attempts. Finally, organizations should conduct penetration testing and vulnerability scanning focused on Solr instances to confirm the absence of this vulnerability post-mitigation.