dbcve.org
EngageApplication · Nice

CVE-2019-7727

CRITICAL · 9.8 CVSS v3.0 Published 2019-04-23
Fix available
A fix is available. Upgrade to after 6.5 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
In NICE Engage through 6.5, the default configuration binds an unauthenticated JMX/RMI interface to all network interfaces, without restricting registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol by using the JMX connector. The observed affected TCP port is 6338 but, based on the product's configuration, a different one could be vulnerable.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

NICE Engage through version 6.5 ships with a default configuration that exposes an unauthenticated JMX/RMI interface bound to all network interfaces (0.0.0.0). This critical misconfiguration lacks MBean registration restrictions, allowing remote attackers to leverage the JMX connector via RMI protocol to inject and execute arbitrary code by registering malicious MBeans. The vulnerability manifests on TCP port 6338 by default but may appear on other ports based on configuration.

MitigationImmediately restrict JMX/RMI access by enabling authentication, binding to localhost only, or disabling remote JMX entirely if not required. Network-level controls such as firewalls or ACLs should isolate the JMX port from untrusted networks until proper authentication is configured.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
EngageApplication
Affected:<= 6.5

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify NICE Engage installation and version
    Locate the NICE Engage installation directory and check the version. Common paths include C:\Program Files\NICE\Engage or /opt/nice/engage. Look for version info in about dialog, manifest files, or a version.txt file in the installation root.
    Affected if The installed version is 6.5 or lower.
  2. Verify JMX/RMI port is listening
    Use netstat or similar tool to check if port 6338 (or the configured JMX port) is open and listening. Run: netstat -an | grep 6338 or ss -tlnp | grep 6338. Also check for any additional ports if JMX was reconfigured.
    Affected if Port 6338 (or a configured JMX port) is listening on 0.0.0.0 or ::: indicating binding to all network interfaces.
  3. Inspect JMX configuration for authentication
    Locate JMX configuration files in the NICE Engage installation directory. Common locations include conf/ or config/ subdirectories. Look for files like jmxremote.password, jmxremote.access, or similar JMX-related XML/properties files. Check for com.sun.management.jmxremote.authenticate=false or missing user credential entries.
    Affected if JMX authentication is explicitly disabled or no user credentials are defined in the configuration.
  4. Confirm JMX network binding settings
    Examine startup scripts (bat, sh) or JMX configuration for com.sun.management.jmxremote.host or similar settings. Verify if the JMX connector is bound to 0.0.0.0 instead of localhost/127.0.0.1.
    Affected if JMX/RMI is bound to 0.0.0.0 making it accessible from any network interface rather than localhost only.

A user is affected if NICE Engage version 6.5 or lower is installed with JMX/RMI port 6338 (or a configured port) listening on 0.0.0.0 and JMX authentication is disabled in the configuration.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Upgrade available Upgrade to a release after 6.5
Interim mitigation

Immediately restrict JMX/RMI access by enabling authentication, binding to localhost only, or disabling remote JMX entirely if not required. Network-level controls such as firewalls or ACLs should isolate the JMX port from untrusted networks until proper authentication is configured.

Fix this in Engage Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing6.0 h
  • Review / QA4.0 h
22.0 hours of engineering $3,860
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,176.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2019-7727 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2019-7727 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data