CVE WatchAug 14, 2026

CVE-2026-66256

** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all v

CVSS

7.2

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Aug 13, 2026 · Last modified: Aug 14, 2026 · CWE-502

EPSS · 30d

Not enough EPSS history yet.

Technical description

** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-7639—

—

———The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group "DNA Apps".6h CVE-2026-198267.3 HIG

—

———A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The project closed the issue report as "not planned" without any further explanation.9h CVE-2026-105715.7 MED

—

———IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.9h CVE-2026-281768.8 HIG

—

———Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.9h CVE-2026-281499.8 CRI

—

———Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.9h CVE-2026-273807.2 HIG

—

———Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.9h