The 'private network' note at the end of this advisory is a red herring that should not reduce your urgency. What this vulnerability actually does is simple and severe: any authenticated user — even one with the lowest privilege level — can escape the JEXL sandbox and execute arbitrary Java code. That means your authentication layer is now the only boundary between an attacker and full system control.
In most OpenNMS environments, low-privilege accounts are abundant. Service accounts run integrations. Third-party contractors have access. Endpoints get compromised and credentials reused. The 'low privilege required' condition that pulled the CVSS score down to 5.4 is satisfied by default for any internal threat actor who can log in — and for many external attackers who have already moved laterally into your network.
The CVSS math assumes the sandbox is a meaningful control. It isn't. Expression language sandboxes have a documented track record of bypasses across SpEL, MVEL, Nashorn, and Groovy — the pattern is genetic, not exceptional. Treat any JEXL sandbox as already compromised; it was never designed as a security boundary, only as a convenience feature that happened to be sandboxed afterward.
But there's a second reason this merits higher priority than the score suggests: OpenNMS is a credential aggregator. It stores credentials for routers, switches, firewalls, servers, and cloud APIs — credentials required for effective monitoring. Code execution on the OpenNMS host doesn't just give you one server; it gives you the master keys to everything that platform monitors. Dump the credential store or query existing node configurations, and you've achieved lateral movement to the entire infrastructure without additional exploits.
Your action items: First, treat this as critical regardless of network placement — the private network assumption is the vulnerability's defense, not yours. Second, audit every account with any OpenNMS access immediately; revoke unused service accounts and rotate any that show signs of compromise. Third, assume the JEXL sandbox is already bypassed in any threat model — implement additional controls around the API layer, restrict which users can access expression-evaluating functions, and monitor for unusual class-loading activity. Fourth, inventory what credentials OpenNMS holds and treat those as tier-one assets: if the platform is compromised, those credentials are compromised, and that cascade is what the CVSS score entirely misses.