Topic

Deserialization: news, advisories and analysis

20 articlesUpdated 29 Oct 2026

CyberSecureToday covers Deserialization across 20 articles published between 14 Sep 2026 and 29 Oct 2026. The coverage includes 20 vulnerability advisories. 20 advisories are rated critical or high severity, and 4 involve flaws listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on Deserialization most often intersect with Remote Code Execution, Security Advisory and Patch & Fix, with Technology, Cloud & SaaS the most affected sector. The most recent story, “Ultimate Deserialization of Untrusted Data vulnerability in Deserialization Flaw Disclosed”, was published 29 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaSCritical
Ultimate Deserialization of Untrusted Data vulnerability in Deserialization Flaw Disclosed
CVE-2026-115968 in Ultimate Deserialization of Untrusted Data vulnerability in (Deserialization) allows remote attackers to trigger arbitrary code executio
Aisha Noor29 Oct 202610 min read
ThreatsCloud & SaaSCritical
Tribulant Deserialization of Untrusted Data vulnerability in Deserialization Flaw Disclosed
CVE-2026-94075 in Tribulant Deserialization of Untrusted Data vulnerability in (Deserialization) allows remote attackers to trigger arbitrary code executio
Aisha Noor24 Oct 202610 min read
ThreatsCloud & SaaSCritical
Deserialization of Untrusted Data vulnerability in Deserialization Flaw Disclosed
CVE-2026-112862 in Deserialization of Untrusted Data vulnerability in (Deserialization) allows remote attackers to trigger arbitrary code execution. Patch:
Aisha Noor23 Oct 202610 min read
ThreatsCloud & SaaSCritical
Google Cloud Enterprise Services Deserialization Flaw Disclosed
CVE-2026-81867 in Google Cloud Enterprise Services (Deserialization) allows remote attackers to trigger arbitrary code execution. Patch: Version 2026-06 an
Aisha Noor19 Oct 202610 min read
ThreatsCloud & SaaSCritical
Apache Deserialization of Untrusted Data vulnerability in Deserialization Flaw Disclosed
CVE-2026-78162 in Apache Deserialization of Untrusted Data vulnerability in (Deserialization) allows remote attackers to trigger arbitrary code execution.
Aisha Noor19 Oct 202610 min read
ThreatsCloud & SaaSCritical
QuantumCloud Deserialization of Untrusted Data vulnerability in Deserialization Flaw Disclosed
CVE-2026-110886 in QuantumCloud Deserialization of Untrusted Data vulnerability in (Deserialization) allows remote attackers to trigger arbitrary code exec
Aisha Noor18 Oct 202610 min read
ThreatsCloud & SaaSCritical
LangChain LCEL Vector Index Deserialization Flaw Enables Arbitrary Code Execution via Compromised Embeddings (CVE-2026-74120)
LangChain issues advisory CVE-2026-74120 for Expression Language vectorstores, patching an unsafe deserialization flaw that allowed remote code execution.
CST Editorial Desk12 Oct 20268 min read
ThreatsCloud & SaaSHigh
Ollama Local AI Model Registry Deserialization Flaw Enables Host Remote Code Execution
A high-severity vulnerability in Ollama allows unauthenticated network actors to trigger remote code execution when pulling tampered GGUF model manifests.
CST Editorial Desk10 Oct 20268 min read
ThreatsCloud & SaaSHigh
vLLM Distributed KV-Cache Memory Deserialization Flaw Enables Arbitrary Model Weight Extraction
A high-severity deserialization vulnerability in vLLM's distributed PagedAttention KV-cache transfer protocol allows attackers to compromise GPU worker nodes.
CST Editorial Desk10 Oct 20268 min read
ThreatsIndustrial & OTCritical
ABB Ability Symphony Plus SCADA S+ Operations Insecure Deserialization Vulnerability Enables Remote Code Execution (CVE-2026-58902)
ABB Cybersecurity and CISA disclose a critical vulnerability in Symphony Plus S+ Operations SCADA software allowing unauthenticated remote code execution on power plant servers.
CST Editorial Desk9 Oct 20268 min read
ThreatsCloud & SaaSCritical
OpenAI Whisper and Triton Flaw Enables Code Execution via Malformed Audio Headers
PyTorch Foundation and OpenAI issue security advisories for speech inference pipelines addressing a critical deserialization flaw enabling arbitrary command execution.
Aisha Noor9 Oct 20268 min read
ThreatsIndustrial & OTCritical
Armatura One Physical Access Control Platform Crippled by Embedded Broker Deserialization and Static Secrets (CVE-2026-94591)
CISA advisory ICSA-26-274-01 warns of embedded ActiveMQ deserialization and hardcoded AES keys in Armatura One, enabling physical security facility takeover.
CST Editorial Desk2 Oct 20269 min read
ThreatsIndustrial & OTCritical
Rockwell Automation FactoryTalk View SE Unauthenticated Deserialization RCE Flaw CVE-2026-51290
CISA Advisory ICSA-26-242-01 warns of a critical unauthenticated remote code execution vulnerability in Rockwell Automation FactoryTalk View SE.
Mei-Lin Chen28 Sep 20268 min read
ThreatsCloud & SaaSHigh
Amazon OpenSearch SQL Plugin Cursor Deserialization Flaw Enables Remote Code Execution CVE-2026-83497
AWS and OpenSearch release bulletin 2026-092-AWS for high-severity flaw CVE-2026-83497 in the SQL plugin allowing authenticated users to execute code via cursors.
CST Editorial Desk23 Sep 202616 min read
ThreatsCloud & SaaSCritical
Microsoft Entra ID Critical Deserialization Vulnerability Enables Unauthenticated Remote Code Execution
Microsoft resolves maximum-severity CVSS 10.0 vulnerability CVE-2026-69836 in Entra ID allowing unauthenticated remote code execution via unsafe object deserialization.
Daniel Okafor19 Sep 202612 min read
ThreatsCloud & SaaSCritical
Microsoft SharePoint Server Critical Deserialization & Auth Bypass Flaws Under Active Cyberattack
CISA orders federal agencies to patch critical Microsoft SharePoint vulnerabilities CVE-2026-58644 and CVE-2026-56164 enabling unauthenticated remote code execution.
Priya Raman18 Sep 202612 min read
ThreatsCloud & SaaSCritical
Microsoft SharePoint Server Critical Deserialization Flaw CVE-2026-50522 Exploited in Active Attacks
CISA adds Microsoft SharePoint Server deserialization flaw CVE-2026-50522 (CVSS 9.8) to its KEV catalog following active exploitation against enterprise document farms.
Priya Raman16 Sep 202611 min read
ThreatsCloud & SaaSCritical
JetBrains TeamCity Critical Deserialization Flaw Exploited in Active CI/CD Attacks
CISA orders federal agencies to patch CVE-2026-63077, an unauthenticated Java deserialization flaw enabling complete remote code execution on TeamCity CI/CD servers.
Priya Raman16 Sep 202610 min read
ThreatsCloud & SaaSCritical
Ajax.NET Professional Object Deserialization Flaw Exploited for Remote Code Execution
Federal agencies and enterprise operators face urgent deadlines as CISA confirms active exploitation of CVE-2021-23758, an unauthenticated deserialization RCE in Ajax.NET Professional.
Daniel Okafor15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Ivanti Patches Critical Remote Code Execution Flaw in Neurons for ITSM Infrastructure
Ivanti released emergency security patches addressing CVE-2026-12650, an unauthenticated deserialization RCE vulnerability in Neurons for ITSM on-premise deployments.
Priya Raman14 Sep 20268 min read