CVE Vulnerability Advisory Database

[Affected Scope] Inactive Apache MINA 3.0.0 branch and applications utilizing its codec module

[Impact] Unrestricted Remote Code Execution (RCE) via gadget chains due to unfiltered deserialization of frame bytes from untrusted peers

[Mitigation] Decommission the unsupported 3.0.0 branch and migrate to the actively maintained Apache MINA 2.2.X branch

[Affected Scope] JetBrains TeamCity versions prior to 2026.1.3 and 2025.11.7

[Impact] Unauthenticated remote attackers can execute arbitrary code on the server via the agent polling protocol, leading to full system compromise

[Mitigation] Immediately upgrade TeamCity server to version 2026.1.3, 2025.11.7, or later

[Affected Scope] Microsoft SharePoint Server deployments

[Impact] Unauthorized remote attackers can execute arbitrary code over the network and fully compromise the system

[Mitigation] Apply the official Microsoft security updates immediately and restrict external network exposure

[Affected Scope] Microsoft SharePoint Server deployments

[Impact] Unauthenticated remote attackers can execute arbitrary code over the network and fully compromise the host server

[Mitigation] Apply the official Microsoft security updates immediately, and restrict network access to SharePoint endpoints until patched

[Affected Scope] All versions of PTC Windchill PDMlink and FlexPLM prior to 11.0 M030, including all CPS releases.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with elevated privileges by deserializing untrusted data.

[Mitigation] Apply the official vendor security patches (CPS) immediately, restrict external network exposure, and enable WAF deserialization detection rules.

[Affected Scope] SolarWinds Web Help Desk (WHD) versions prior to 2026.1

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with high privileges on the host machine by sending specially crafted serialized data

[Mitigation] Immediately upgrade SolarWinds Web Help Desk to version 2026.1 or higher, and restrict external network access to the service

[Affected Scope] Microsoft SharePoint Server deployments

[Impact] Unauthenticated remote attackers can execute arbitrary code over the network and gain full control of the target server.

[Mitigation] Apply the official Microsoft security patches immediately and restrict external access to SharePoint web interfaces until patched.

[Affected Scope] React versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 utilizing React Server Components (RSC), including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages

[Impact] Unauthenticated remote attackers can execute arbitrary code on the server by sending malicious payloads to Server Function endpoints, leading to complete system compromise

[Mitigation] Immediately upgrade React and all associated react-server-dom packages to the latest patched versions, and apply WAF rules to restrict suspicious RSC requests

[Affected Scope] All Windows Server environments running Windows Server Update Services (WSUS).

[Impact] Unauthenticated remote attackers can execute arbitrary code with SYSTEM privileges over the network by sending malicious serialized payloads.

[Mitigation] Apply the official Microsoft security patches immediately, and restrict network access to WSUS ports (8530, 8531) to trusted internal networks.

[Affected Scope] SolarWinds Web Help Desk (WHD) versions 12.8.3 Hotfix 3 and prior

[Impact] Unauthenticated remote attackers can execute arbitrary commands with system privileges on the host machine by sending specially crafted serialized data

[Mitigation] Immediately upgrade to SolarWinds Web Help Desk 12.8.7 Hotfix 1 or later as recommended by the vendor advisory

[Affected Scope] License Servlet component of Fortra GoAnywhere MFT

[Impact] Unauthenticated attackers with a validly forged license response signature can deserialize arbitrary objects, potentially leading to remote command injection and full system compromise

[Mitigation] Immediately apply the official security patches provided by Fortra and restrict external access to the license servlet interfaces

[Affected Scope] Sitecore Experience Manager (XM) and Experience Platform (XP) versions up to and including 9.0

[Impact] Unauthenticated remote attackers can execute arbitrary code and fully compromise the host system via deserialization of untrusted data

[Mitigation] Immediately apply the official security patches from the vendor, or implement temporary workarounds such as enforcing ViewState encryption and restricting access

[Affected Scope] Dassault Systèmes DELMIA Apriso from Release 2020 through Release 2025.

[Impact] Successful exploitation allows unauthenticated remote attackers to execute arbitrary code with system privileges via specially crafted serialized payloads.

[Mitigation] Immediately apply the official vendor security patches, restrict external network exposure, and perform compromise assessment using IoC logs.

[Affected Scope] Roundcube Webmail versions before 1.5.10 and 1.6.x versions before 1.6.11

[Impact] Authenticated remote attackers can trigger PHP Object Deserialization via the manipulated _from parameter, leading to arbitrary Remote Code Execution (RCE) on the host server

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.10, 1.6.11, or later)

[Affected Scope] Systems utilizing the SAP NetWeaver Visual Composer Metadata Uploader module

[Impact] A privileged attacker can upload untrusted or malicious content, triggering deserialization of untrusted data (CWE-502) and potentially compromising the confidentiality, integrity, and availability of the host system

[Mitigation] Immediately apply the official security patch (SAP Note 3604119) and restrict access to unauthorized metadata upload endpoints

[Affected Scope] Gladinet CentreStack versions through 16.1.10296.56315

[Impact] Unauthenticated remote code execution (RCE) via deserialization of malicious payloads using the hardcoded machineKey, actively exploited in the wild

[Mitigation] Immediately upgrade to version 16.4.10315.56368 or later, or manually delete/rotate the hardcoded machineKey in the portal web.config file

[Affected Scope] Wazuh server and cluster environments running versions 4.4.0 through 4.9.0

[Impact] Attackers with API access or compromised agents can execute arbitrary Python code on the Wazuh server by manipulating Distributed API (DAPI) parameters, leading to full system compromise

[Mitigation] Immediately upgrade Wazuh manager and cluster nodes to the patched version (v4.9.1 or higher) and restrict API access

[Affected Scope] SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC)

[Impact] A remote unauthenticated attacker can exploit a deserialization of untrusted data vulnerability to execute arbitrary OS commands on the target system

[Mitigation] Immediately apply the official security patches provided by SonicWall and restrict external access to the management consoles

[Affected Scope] SolarWinds Web Help Desk (WHD) 12.8.3 and all prior versions

[Impact] Successful exploitation allows remote attackers to execute arbitrary commands on the host machine via unsafe Java deserialization, potentially leading to full system compromise

[Mitigation] Immediately apply the official SolarWinds Web Help Desk 12.8.3 Hotfix 1 or upgrade to the latest patched version

[Affected Scope] Apache ActiveMQ brokers and client libraries utilizing the OpenWire protocol

[Impact] Unauthenticated remote attackers can execute arbitrary shell commands on the target system by manipulating serialized class types

[Mitigation] Immediately upgrade both brokers and clients to patched versions (5.15.16, 5.16.7, 5.17.6, or 5.18.3 and above)