Common Weakness Enumeration

CWE-502

Allowed

Deserialization of Untrusted Data

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

5669 vulnerabilities reference this CWE, most recent first.

CVE-2026-18490 (GCVE-0-2026-18490)

Vulnerability from cvelistv5 – Published: 2026-09-23 15:45 – Updated: 2026-09-23 19:44
VLAI
Title
IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
Summary
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint (BrmRMISSLServerSocketFactory.java:95, EP8). An adjacent-network attacker can deliver a crafted serialized payload to achieve arbitrary code execution, exposing all PayDir credentials and enabling manipulation of payment business rules.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 18:13 UTC
CWE
  • CWE-502 - Deserialization of Untrusted Data
Assigner
References
URL Tags
https://www.ibm.com/support/pages/node/7288641 vendor-advisorypatch
Impacted products
Vendor Product Version
IBM Financial Transaction Manager (FTM) for RedHat OpenShift Affected: 4.0.6.0 , ≤ 4.0.10.0 (semver)
    cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18490",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T18:13:02.634803Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T19:44:48.501Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*"
          ],
          "product": "Financial Transaction Manager (FTM)\u00a0for RedHat OpenShift",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "4.0.10.0",
              "status": "affected",
              "version": "4.0.6.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint (BrmRMISSLServerSocketFactory.java:95, EP8). An adjacent-network attacker can deliver a crafted serialized payload to achieve arbitrary code execution, exposing all PayDir credentials and enabling manipulation of payment business rules.\u003c/p\u003e"
            }
          ],
          "value": "IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint (BrmRMISSLServerSocketFactory.java:95, EP8). An adjacent-network attacker can deliver a crafted serialized payload to achieve arbitrary code execution, exposing all PayDir credentials and enabling manipulation of payment business rules."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T15:45:29.558Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7288641"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM strongly recommends addressing the vulnerabilities now by updating FTM deployments to the following\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eAffected Product(s)\u003c/td\u003e\u003ctd\u003eResolved by VRMF\u003c/td\u003e\u003ctd\u003eRemediation / First Fix\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eFinancial Transaction Manager (FTM)\u00a0for RedHat OpenShift\u003c/td\u003e\u003ctd\u003e4.0.11.0\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/support/pages/node/7285661\" rel=\"nofollow\"\u003eFTM 4.0.11.0\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
            }
          ],
          "value": "IBM strongly recommends addressing the vulnerabilities now by updating FTM deployments to the following\n\n\n\n\n\nAffected Product(s)Resolved by VRMFRemediation / First FixFinancial Transaction Manager (FTM)\u00a0for RedHat OpenShift4.0.11.0 FTM 4.0.11.0 https://www.ibm.com/support/pages/node/7285661"
        }
      ],
      "title": "IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-18490",
    "datePublished": "2026-09-23T15:45:29.558Z",
    "dateReserved": "2026-07-31T14:02:24.096Z",
    "dateUpdated": "2026-09-23T19:44:48.501Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18285 (GCVE-0-2026-18285)

Vulnerability from cvelistv5 – Published: 2026-08-20 16:20 – Updated: 2026-08-21 20:08
VLAI
Title
Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability
Summary
Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the load_rehab_pile_dataset method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28749.
Severity
7.8 (High)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 19:54 UTC
CWE
  • CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
Vendor Product Version
aeon aeon Affected: 1.3.0
Create a notification for this product.
Date Public
2026-07-29 21:31
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18285",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T19:54:21.311084Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T20:08:40.846Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "aeon",
          "vendor": "aeon",
          "versions": [
            {
              "status": "affected",
              "version": "1.3.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-07-29T17:07:09.509Z",
      "datePublic": "2026-07-29T21:31:01.851Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the load_rehab_pile_dataset method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28749."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T16:20:20.776Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-468",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-468/"
        },
        {
          "name": "vendor-provided URL",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/aeon-toolkit/aeon/commit/751918052c0cce266b4f7cd4b084408526efc015"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Anonymous"
      },
      "title": "Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-18285",
    "datePublished": "2026-08-20T16:20:20.776Z",
    "dateReserved": "2026-07-29T17:07:09.476Z",
    "dateUpdated": "2026-08-21T20:08:40.846Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18163 (GCVE-0-2026-18163)

Vulnerability from cvelistv5 – Published: 2026-09-22 22:11 – Updated: 2026-09-23 18:56
VLAI
Title
IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
Summary
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 18:48 UTC
CWE
  • CWE-502 - Deserialization of Untrusted Data
Assigner
References
URL Tags
https://www.ibm.com/support/pages/node/7288641 vendor-advisorypatch
Impacted products
Vendor Product Version
IBM Financial Transaction Manager (FTM) for RedHat OpenShift Affected: 4.0.6.0 , ≤ 4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800)4.0.7.04.0.8.04.0.9.04.0.10.0 Interim Fix 064 (semver)
    cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18163",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T18:48:47.117881Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T18:56:57.110Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*"
          ],
          "product": "Financial Transaction Manager (FTM)\u00a0for RedHat OpenShift",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800)4.0.7.04.0.8.04.0.9.04.0.10.0 Interim Fix 064",
              "status": "affected",
              "version": "4.0.6.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data.\u003c/p\u003e"
            }
          ],
          "value": "IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T22:11:59.192Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7288641"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM strongly recommends addressing the vulnerabilities now by updating FTM deployments to the following\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eAffected Product(s)\u003c/td\u003e\u003ctd\u003eResolved by VRMF\u003c/td\u003e\u003ctd\u003eRemediation / First Fix\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eFinancial Transaction Manager (FTM)\u00a0for RedHat OpenShift\u003c/td\u003e\u003ctd\u003e4.0.11.0\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/support/pages/node/7285661\" rel=\"nofollow\"\u003eFTM 4.0.11.0\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
            }
          ],
          "value": "IBM strongly recommends addressing the vulnerabilities now by updating FTM deployments to the following\n\n\n\n\n\nAffected Product(s)Resolved by VRMFRemediation / First FixFinancial Transaction Manager (FTM)\u00a0for RedHat OpenShift4.0.11.0 FTM 4.0.11.0 https://www.ibm.com/support/pages/node/7285661"
        }
      ],
      "title": "IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-18163",
    "datePublished": "2026-09-22T22:11:59.192Z",
    "dateReserved": "2026-07-28T20:11:59.157Z",
    "dateUpdated": "2026-09-23T18:56:57.110Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-17637 (GCVE-0-2026-17637)

Vulnerability from cvelistv5 – Published: 2026-09-22 21:31 – Updated: 2026-09-23 14:35
VLAI
Title
IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
Summary
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 14:11 UTC
CWE
  • CWE-502 - Deserialization of Untrusted Data
Assigner
References
URL Tags
https://www.ibm.com/support/pages/node/7288641 vendor-advisorypatch
Impacted products
Vendor Product Version
IBM Financial Transaction Manager (FTM) for RedHat OpenShift Affected: 4.0.6.0 , ≤ 4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800)4.0.7.04.0.8.04.0.9.04.0.10.0 Interim Fix 064 (semver)
    cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-17637",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T14:11:57.521935Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T14:35:18.494Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*"
          ],
          "product": "Financial Transaction Manager (FTM)\u00a0for RedHat OpenShift",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800)4.0.7.04.0.8.04.0.9.04.0.10.0 Interim Fix 064",
              "status": "affected",
              "version": "4.0.6.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data.\u003c/p\u003e"
            }
          ],
          "value": "IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T21:31:59.604Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7288641"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM strongly recommends addressing the vulnerabilities now by updating FTM deployments to the following\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eAffected Product(s)\u003c/td\u003e\u003ctd\u003eResolved by VRMF\u003c/td\u003e\u003ctd\u003eRemediation / First Fix\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eFinancial Transaction Manager (FTM)\u00a0for RedHat OpenShift\u003c/td\u003e\u003ctd\u003e4.0.11.0\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/support/pages/node/7285661\" rel=\"nofollow\"\u003eFTM 4.0.11.0\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
            }
          ],
          "value": "IBM strongly recommends addressing the vulnerabilities now by updating FTM deployments to the following\n\n\n\n\n\nAffected Product(s)Resolved by VRMFRemediation / First FixFinancial Transaction Manager (FTM)\u00a0for RedHat OpenShift4.0.11.0 FTM 4.0.11.0 https://www.ibm.com/support/pages/node/7285661"
        }
      ],
      "title": "IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-17637",
    "datePublished": "2026-09-22T21:31:59.604Z",
    "dateReserved": "2026-07-27T21:37:55.770Z",
    "dateUpdated": "2026-09-23T14:35:18.494Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-17416 (GCVE-0-2026-17416)

Vulnerability from cvelistv5 – Published: 2026-09-14 19:40 – Updated: 2026-09-15 16:32
VLAI
Title
IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs
Summary
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 03:56 UTC
CWE
  • CWE-502 - Deserialization of Untrusted Data
Assigner
References
URL Tags
https://www.ibm.com/support/pages/node/7286530 vendor-advisorypatch
Impacted products
Vendor Product Version
IBM App Connect Enterprise Affected: 13.0.1.0 , ≤ 13.0.8.0 (semver)
Affected: 12.0.1.0 , ≤ 12.0.12.27 (semver)
    cpe:2.3:a:ibm:app_connect_enterprise:13.0.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:app_connect_enterprise:13.0.8.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:app_connect_enterprise:12.0.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:app_connect_enterprise:12.0.12.27:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-17416",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T03:56:20.456683Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T16:32:28.080Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:app_connect_enterprise:13.0.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise:13.0.8.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise:12.0.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise:12.0.12.27:*:*:*:*:*:*:*"
          ],
          "product": "App Connect Enterprise",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "13.0.8.0",
              "status": "affected",
              "version": "13.0.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.0.12.27",
              "status": "affected",
              "version": "12.0.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.\u003c/p\u003e"
            }
          ],
          "value": "IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T19:40:11.076Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7286530"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003eIBM strongly recommends addressing the vulnerability/vulnerabilities now by applying the appropriate fix to IBM App Connect Enterprise\u003c/strong\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eAffected Product(s)\u003c/td\u003e\u003ctd\u003eVersion(s)\u003c/td\u003e\u003ctd\u003eAPAR\u003c/td\u003e\u003ctd\u003eRemediation / Fixes\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM App Connect Enterprise\u003c/td\u003e\u003ctd\u003e13.0.1.0 - 13.0.8.0\u003c/td\u003e\u003ctd\u003eIT49855\u003c/td\u003e\u003ctd\u003e\u003cp\u003eThe APAR (IT49855) is available from\u00a0\u003c/p\u003e\u003cp\u003e\u003ca href=\"https://www.ibm.com/support/pages/node/7281824\" rel=\"noopener noreferrer nofollow\"\u003eBM App Connect Enterprise v13- Fix Pack Release 13.0.8.1\u003c/a\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM App Connect Enterprise\u003c/td\u003e\u003ctd\u003e12.0.1.0 - 12.0.12.27\u003c/td\u003e\u003ctd\u003eIT49855\u003c/td\u003e\u003ctd\u003e\u003cp\u003eThe APAR (IT49855) is available from\u00a0\u003c/p\u003e\u003cp\u003e\u003ca href=\"https://www.ibm.com/support/pages/node/7280244\" rel=\"noopener noreferrer nofollow\"\u003eIBM App Connect Enterprise v12- Fix Pack Release 12.0.12.28\u003c/a\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
            }
          ],
          "value": "IBM strongly recommends addressing the vulnerability/vulnerabilities now by applying the appropriate fix to IBM App Connect Enterprise\n\nAffected Product(s)Version(s)APARRemediation / FixesIBM App Connect Enterprise13.0.1.0 - 13.0.8.0IT49855\n\nThe APAR (IT49855) is available from\u00a0\n\n\n\n BM App Connect Enterprise v13- Fix Pack Release 13.0.8.1 https://www.ibm.com/support/pages/node/7281824 \n\nIBM App Connect Enterprise12.0.1.0 - 12.0.12.27IT49855\n\nThe APAR (IT49855) is available from\u00a0\n\n\n\n IBM App Connect Enterprise v12- Fix Pack Release 12.0.12.28 https://www.ibm.com/support/pages/node/7280244"
        }
      ],
      "title": "IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-17416",
    "datePublished": "2026-09-14T19:40:11.076Z",
    "dateReserved": "2026-07-25T05:43:17.779Z",
    "dateUpdated": "2026-09-15T16:32:28.080Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-17156 (GCVE-0-2026-17156)

Vulnerability from cvelistv5 – Published: 2026-09-14 19:40 – Updated: 2026-09-15 03:56
VLAI
Title
IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs
Summary
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 00:00 UTC
CWE
  • CWE-502 - Deserialization of Untrusted Data
Assigner
References
URL Tags
https://www.ibm.com/support/pages/node/7286530 vendor-advisorypatch
Impacted products
Vendor Product Version
IBM App Connect Enterprise Affected: 13.0.1.0 , ≤ 13.0.8.0 (semver)
Affected: 12.0.1.0 , ≤ 12.0.12.27 (semver)
    cpe:2.3:a:ibm:app_connect_enterprise:13.0.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:app_connect_enterprise:13.0.8.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:app_connect_enterprise:12.0.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:app_connect_enterprise:12.0.12.27:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-17156",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T03:56:18.627Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:app_connect_enterprise:13.0.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise:13.0.8.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise:12.0.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise:12.0.12.27:*:*:*:*:*:*:*"
          ],
          "product": "App Connect Enterprise",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "13.0.8.0",
              "status": "affected",
              "version": "13.0.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.0.12.27",
              "status": "affected",
              "version": "12.0.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.\u003c/p\u003e"
            }
          ],
          "value": "IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T19:40:51.059Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7286530"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003eIBM strongly recommends addressing the vulnerability/vulnerabilities now by applying the appropriate fix to IBM App Connect Enterprise\u003c/strong\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eAffected Product(s)\u003c/td\u003e\u003ctd\u003eVersion(s)\u003c/td\u003e\u003ctd\u003eAPAR\u003c/td\u003e\u003ctd\u003eRemediation / Fixes\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM App Connect Enterprise\u003c/td\u003e\u003ctd\u003e13.0.1.0 - 13.0.8.0\u003c/td\u003e\u003ctd\u003eIT49855\u003c/td\u003e\u003ctd\u003e\u003cp\u003eThe APAR (IT49855) is available from\u00a0\u003c/p\u003e\u003cp\u003e\u003ca href=\"https://www.ibm.com/support/pages/node/7281824\" rel=\"noopener noreferrer nofollow\"\u003eBM App Connect Enterprise v13- Fix Pack Release 13.0.8.1\u003c/a\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM App Connect Enterprise\u003c/td\u003e\u003ctd\u003e12.0.1.0 - 12.0.12.27\u003c/td\u003e\u003ctd\u003eIT49855\u003c/td\u003e\u003ctd\u003e\u003cp\u003eThe APAR (IT49855) is available from\u00a0\u003c/p\u003e\u003cp\u003e\u003ca href=\"https://www.ibm.com/support/pages/node/7280244\" rel=\"noopener noreferrer nofollow\"\u003eIBM App Connect Enterprise v12- Fix Pack Release 12.0.12.28\u003c/a\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
            }
          ],
          "value": "IBM strongly recommends addressing the vulnerability/vulnerabilities now by applying the appropriate fix to IBM App Connect Enterprise\n\nAffected Product(s)Version(s)APARRemediation / FixesIBM App Connect Enterprise13.0.1.0 - 13.0.8.0IT49855\n\nThe APAR (IT49855) is available from\u00a0\n\n\n\n BM App Connect Enterprise v13- Fix Pack Release 13.0.8.1 https://www.ibm.com/support/pages/node/7281824 \n\nIBM App Connect Enterprise12.0.1.0 - 12.0.12.27IT49855\n\nThe APAR (IT49855) is available from\u00a0\n\n\n\n IBM App Connect Enterprise v12- Fix Pack Release 12.0.12.28 https://www.ibm.com/support/pages/node/7280244"
        }
      ],
      "title": "IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-17156",
    "datePublished": "2026-09-14T19:40:51.059Z",
    "dateReserved": "2026-07-24T17:43:32.188Z",
    "dateUpdated": "2026-09-15T03:56:18.627Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-17086 (GCVE-0-2026-17086)

Vulnerability from cvelistv5 – Published: 2026-09-18 03:38 – Updated: 2026-09-18 14:31
VLAI
Title
ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content
Summary
The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 14:18 UTC
CWE
  • CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
Credits
Josh Bolding
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-17086",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T14:18:23.587550Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T14:31:42.846Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ShortPixel Image Optimizer \u2013 Optimize Images, Convert WebP \u0026 AVIF",
          "vendor": "shortpixel",
          "versions": [
            {
              "lessThanOrEqual": "6.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Josh Bolding"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The ShortPixel Image Optimizer \u2013 Optimize Images, Convert WebP \u0026 AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T03:38:12.820Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/89ef2ee1-2bec-459f-9a85-c260cbb129ca?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.5.4/build/shortpixel/replacer2/src/Replacer.php#L402"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.5.4/build/shortpixel/replacer2/src/Replacer.php#L425"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.5.4/build/shortpixel/replacer2/src/Replacer.php#L429"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.5.4/build/shortpixel/replacer2/src/Replacer.php#L446"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.5.4/class/Controller/Optimizer/OptimizeAiController.php#L598"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.5.4/build/shortpixel/replacer2/src/Replacer.php#L259"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.5.1/build/shortpixel/replacer2/src/Replacer.php#L402"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.5.1/build/shortpixel/replacer2/src/Replacer.php#L425"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.5.1/build/shortpixel/replacer2/src/Replacer.php#L429"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.5.1/build/shortpixel/replacer2/src/Replacer.php#L446"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.5.1/class/Controller/Optimizer/OptimizeAiController.php#L598"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.5.1/build/shortpixel/replacer2/src/Replacer.php#L259"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3688579%40shortpixel-image-optimiser\u0026new=3688579%40shortpixel-image-optimiser"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-31T21:06:36.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-17T14:29:30.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "ShortPixel Image Optimizer \u003c= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-17086",
    "datePublished": "2026-09-18T03:38:12.820Z",
    "dateReserved": "2026-07-24T14:41:24.795Z",
    "dateUpdated": "2026-09-18T14:31:42.846Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-17061 (GCVE-0-2026-17061)

Vulnerability from cvelistv5 – Published: 2026-08-11 14:21 – Updated: 2026-08-11 19:44
VLAI
Title
Deserialization of Untrusted Data Vulnerability in SIMULIA Execution Engine from Release 2023 through Release 2026
Summary
A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution.
Severity
10 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 19:28 UTC
CWE
  • CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
Vendor Product Version
Dassault Systèmes SIMULIA Execution Engine Affected: Release 2023 Golden
Affected: Release 2024 Golden , ≤ Release 2024 FP.CFA.2615 (custom)
Affected: Release 2025 Golden , ≤ Release 2025 FP.CFA.2628 (custom)
Affected: Release 2026 Golden , ≤ Release 2026 FP.CFA.2624 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-17061",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T19:28:46.275357Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T19:44:09.908Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SIMULIA Execution Engine",
          "vendor": "Dassault Syst\u00e8mes",
          "versions": [
            {
              "status": "affected",
              "version": "Release 2023 Golden"
            },
            {
              "lessThanOrEqual": "Release 2024 FP.CFA.2615",
              "status": "affected",
              "version": "Release 2024 Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "Release 2025 FP.CFA.2628",
              "status": "affected",
              "version": "Release 2025 Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "Release 2026 FP.CFA.2624",
              "status": "affected",
              "version": "Release 2026 Golden",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution."
            }
          ],
          "value": "A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T14:21:22.911Z",
        "orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
        "shortName": "3DS"
      },
      "references": [
        {
          "url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2026-17061"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Deserialization of Untrusted Data Vulnerability in SIMULIA Execution Engine from Release 2023 through Release 2026",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
    "assignerShortName": "3DS",
    "cveId": "CVE-2026-17061",
    "datePublished": "2026-08-11T14:21:22.911Z",
    "dateReserved": "2026-07-24T13:46:13.875Z",
    "dateUpdated": "2026-08-11T19:44:09.908Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16723 (GCVE-0-2026-16723)

Vulnerability from cvelistv5 – Published: 2026-07-23 08:26 – Updated: 2026-07-23 13:54
VLAI
Title
Remote Code Execution in fastjson 1.2.68–1.2.83
Summary
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
Severity
9 (Critical)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-23 13:54 UTC
CWE
  • CWE-20 - Improper input validation
  • CWE-502 - Deserialization of untrusted data
Assigner
References
URL Tags
https://github.com/alibaba/fastjson2/wiki/Securit… vendor-advisorymitigation
Impacted products
Vendor Product Version
Alibaba Fastjson Affected: 1.2.68 , ≤ 1.2.83 (custom)
Create a notification for this product.
Credits
Kirill Firsov of FearsOff Cybersecurity
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-16723",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T13:54:05.935678Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T13:54:13.031Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Fastjson",
          "vendor": "Alibaba",
          "versions": [
            {
              "lessThanOrEqual": "1.2.83",
              "status": "affected",
              "version": "1.2.68",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kirill Firsov of FearsOff Cybersecurity"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson\u0027s\u0026nbsp;\u003cstrong\u003estock default configuration\u003c/strong\u003e\u0026nbsp;\u2014 no AutoType enablement required, no classpath gadget required.\u003c/p\u003e"
            }
          ],
          "value": "A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson\u0027s\u00a0stock default configuration\u00a0\u2014 no AutoType enablement required, no classpath gadget required."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-586",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-586 Object Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper input validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of untrusted data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T08:26:24.453Z",
        "orgId": "0cc2b86d-1d45-434d-ae74-11d09ec61ae8",
        "shortName": "alibaba"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "mitigation"
          ],
          "url": "https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Remote Code Execution in fastjson 1.2.68\u20131.2.83",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0cc2b86d-1d45-434d-ae74-11d09ec61ae8",
    "assignerShortName": "alibaba",
    "cveId": "CVE-2026-16723",
    "datePublished": "2026-07-23T08:26:24.453Z",
    "dateReserved": "2026-07-23T02:40:02.606Z",
    "dateUpdated": "2026-07-23T13:54:13.031Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16502 (GCVE-0-2026-16502)

Vulnerability from cvelistv5 – Published: 2026-09-08 11:29 – Updated: 2026-09-08 16:12
VLAI
Title
Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode
Summary
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:48 UTC
CWE
  • CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
Credits
Muhammad Yudha - DJ
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-16502",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T14:48:54.252387Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T16:12:50.113Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Live Composer \u2013 Free WordPress Website Builder",
          "vendor": "livecomposer",
          "versions": [
            {
              "lessThanOrEqual": "2.1.18",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Muhammad Yudha - DJ"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Live Composer \u2013 Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T11:29:58.916Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1db28477-8982-4e47-b5ed-26fd211ee925?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.10/modules/downloads/module.php#L5685"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.10/modules/downloads/module.php#L4972"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.16/modules/downloads/module.php#L4975"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.16/modules/downloads/module.php#L4972"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.16/modules/downloads/module.php#L5685"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.10/modules/downloads/module.php#L4975"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3628023/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-21T19:04:28.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-07T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Live Composer \u003c= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-16502",
    "datePublished": "2026-09-08T11:29:58.916Z",
    "dateReserved": "2026-07-21T18:48:52.754Z",
    "dateUpdated": "2026-09-08T16:12:50.113Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation
Architecture and Design Implementation

If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.

Mitigation
Implementation

When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Mitigation
Implementation

Explicitly define a final object() to prevent deserialization.

Mitigation
Architecture and Design Implementation
  • Make fields transient to protect them from deserialization.
  • An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.
Mitigation
Implementation

Avoid having unnecessary types or gadgets (a sequence of instances and method invocations that can self-execute during the deserialization process, often found in libraries) available that can be leveraged for malicious ends. This limits the potential for unintended or unauthorized types and gadgets to be leveraged by the attacker. Add only acceptable classes to an allowlist. Note: new gadgets are constantly being discovered, so this alone is not a sufficient mitigation.

Mitigation
Architecture and Design Implementation

Employ cryptography of the data or code for protection. However, it's important to note that it would still be client-side security. This is risky because if the client is compromised then the security implemented on the client (the cryptography) can be bypassed.

Mitigation MIT-29
Operation

Strategy: Firewall

Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].

CAPEC-586: Object Injection

An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects. Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.

← Back to the CWE list