CVE-2026-3967

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3967", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-11T13:36:15.186Z", "datePublished": "2026-03-12T00:02:10.401Z", "dateUpdated": "2026-03-12T13:26:26.778Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-12T00:02:10.401Z"}, "title": "Alfresco Activiti Process Variable Serialization System SerializableType.java createObjectInputStream deserialization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-502", "lang": "en", "description": "Deserialization"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-20", "lang": "en", "description": "Improper Input Validation"}]}], "affected": [{"vendor": "Alfresco", "product": "Activiti", "versions": [{"version": "7.0", "status": "affected"}, {"version": "7.1", "status": "affected"}, {"version": "7.2", "status": "affected"}, {"version": "7.3", "status": "affected"}, {"version": "7.4", "status": "affected"}, {"version": "7.5", "status": "affected"}, {"version": "7.6", "status": "affected"}, {"version": "7.7", "status": "affected"}, {"version": "7.8", "status": "affected"}, {"version": "7.9", "status": "affected"}, {"version": "7.10", "status": "affected"}, {"version": "7.11", "status": "affected"}, {"version": "7.12", "status": "affected"}, {"version": "7.13", "status": "affected"}, {"version": "7.14", "status": "affected"}, {"version": "7.15", "status": "affected"}, {"version": "7.16", "status": "affected"}, {"version": "7.17", "status": "affected"}, {"version": "7.18", "status": "affected"}, {"version": "7.19", "status": "affected"}, {"version": "8.0", "status": "affected"}, {"version": "8.1", "status": "affected"}, {"version": "8.2", "status": "affected"}, {"version": "8.3", "status": "affected"}, {"version": "8.4", "status": "affected"}, {"version": "8.5", "status": "affected"}, {"version": "8.6", "status": "affected"}, {"version": "8.7", "status": "affected"}, {"version": "8.8.0", "status": "affected"}], "modules": ["Process Variable Serialization System"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in Alfresco Activiti up to 7.19/8.8.0. Affected by this issue is the function deserialize/createObjectInputStream of the file activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/variable/SerializableType.java of the component Process Variable Serialization System. This manipulation causes deserialization. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-11T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-11T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-11T14:41:21.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Ana10gy (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/?id.350396", "name": "VDB-350396 | Alfresco Activiti Process Variable Serialization System SerializableType.java createObjectInputStream deserialization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.350396", "name": "VDB-350396 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.768942", "name": "Submit #768942 | Activiti <=7.20 or < 8.8.0 Deserialization", "tags": ["third-party-advisory"]}, {"url": "https://github.com/AnalogyC0de/public_exp/issues/16", "tags": ["exploit", "issue-tracking"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T13:26:20.303772Z", "id": "CVE-2026-3967", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T13:26:26.778Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3967", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T13:26:20.303772Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T13:26:23.045Z"}}], "cna": {"title": "Alfresco Activiti Process Variable Serialization System SerializableType.java createObjectInputStream deserialization", "credits": [{"lang": "en", "type": "reporter", "value": "Ana10gy (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "Alfresco", "modules": ["Process Variable Serialization System"], "product": "Activiti", "versions": [{"status": "affected", "version": "7.0"}, {"status": "affected", "version": "7.1"}, {"status": "affected", "version": "7.2"}, {"status": "affected", "version": "7.3"}, {"status": "affected", "version": "7.4"}, {"status": "affected", "version": "7.5"}, {"status": "affected", "version": "7.6"}, {"status": "affected", "version": "7.7"}, {"status": "affected", "version": "7.8"}, {"status": "affected", "version": "7.9"}, {"status": "affected", "version": "7.10"}, {"status": "affected", "version": "7.11"}, {"status": "affected", "version": "7.12"}, {"status": "affected", "version": "7.13"}, {"status": "affected", "version": "7.14"}, {"status": "affected", "version": "7.15"}, {"status": "affected", "version": "7.16"}, {"status": "affected", "version": "7.17"}, {"status": "affected", "version": "7.18"}, {"status": "affected", "version": "7.19"}, {"status": "affected", "version": "8.0"}, {"status": "affected", "version": "8.1"}, {"status": "affected", "version": "8.2"}, {"status": "affected", "version": "8.3"}, {"status": "affected", "version": "8.4"}, {"status": "affected", "version": "8.5"}, {"status": "affected", "version": "8.6"}, {"status": "affected", "version": "8.7"}, {"status": "affected", "version": "8.8.0"}]}], "timeline": [{"lang": "en", "time": "2026-03-11T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-11T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-11T14:41:21.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.350396", "name": "VDB-350396 | Alfresco Activiti Process Variable Serialization System SerializableType.java createObjectInputStream deserialization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.350396", "name": "VDB-350396 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.768942", "name": "Submit #768942 | Activiti <=7.20 or < 8.8.0 Deserialization", "tags": ["third-party-advisory"]}, {"url": "https://github.com/AnalogyC0de/public_exp/issues/16", "tags": ["exploit", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in Alfresco Activiti up to 7.19/8.8.0. Affected by this issue is the function deserialize/createObjectInputStream of the file activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/variable/SerializableType.java of the component Process Variable Serialization System. This manipulation causes deserialization. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "Deserialization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "Improper Input Validation"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-12T00:02:10.401Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3967", "state": "PUBLISHED", "dateUpdated": "2026-03-12T13:26:26.778Z", "dateReserved": "2026-03-11T13:36:15.186Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-12T00:02:10.401Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Process Variable Serialization System"], "product": "Activiti", "vendor": "Alfresco", "versions": [{"status": "affected", "version": "7.0"}, {"status": "affected", "version": "7.1"}, {"status": "affected", "version": "7.2"}, {"status": "affected", "version": "7.3"}, {"status": "affected", "version": "7.4"}, {"status": "affected", "version": "7.5"}, {"status": "affected", "version": "7.6"}, {"status": "affected", "version": "7.7"}, {"status": "affected", "version": "7.8"}, {"status": "affected", "version": "7.9"}, {"status": "affected", "version": "7.10"}, {"status": "affected", "version": "7.11"}, {"status": "affected", "version": "7.12"}, {"status": "affected", "version": "7.13"}, {"status": "affected", "version": "7.14"}, {"status": "affected", "version": "7.15"}, {"status": "affected", "version": "7.16"}, {"status": "affected", "version": "7.17"}, {"status": "affected", "version": "7.18"}, {"status": "affected", "version": "7.19"}, {"status": "affected", "version": "8.0"}, {"status": "affected", "version": "8.1"}, {"status": "affected", "version": "8.2"}, {"status": "affected", "version": "8.3"}, {"status": "affected", "version": "8.4"}, {"status": "affected", "version": "8.5"}, {"status": "affected", "version": "8.6"}, {"status": "affected", "version": "8.7"}, {"status": "affected", "version": "8.8.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in Alfresco Activiti up to 7.19/8.8.0. Affected by this issue is the function deserialize/createObjectInputStream of the file activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/variable/SerializableType.java of the component Process Variable Serialization System. This manipulation causes deserialization. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en Alfresco Activiti hasta 7.19/8.8.0. Afectada por este problema es la funci\u00f3n deserialize/createObjectInputStream del archivo activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/variable/SerializableType.java del componente Process Variable Serialization System. Esta manipulaci\u00f3n causa deserializaci\u00f3n. La explotaci\u00f3n remota del ataque es posible. El exploit ha sido publicado y puede ser utilizado. Se contact\u00f3 al proveedor con antelaci\u00f3n sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-3967", "lastModified": "2026-06-17T10:44:31.933", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3967", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T13:26:20.303772Z", "version": "2.0.3"}}]}, "published": "2026-03-12T00:16:12.477", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/AnalogyC0de/public_exp/issues/16"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.350396"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.350396"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.768942"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-502"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.13"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.14"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.16"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.17"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.18"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.19"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.8.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Activiti", "source": "cna", "vendor": "Alfresco"}, "product": "activiti", "vendor": "alfresco"}], "analysis": {"en": {"generated_at": "2026-03-18T15:23:42.788142+00:00", "value": {"mitigation_remediation": ["Apply the latest Alfresco Activiti release that is newer than 7.19 or 8.8.0 to eliminate the known deserialization flaw."], "summary": {"action": "Immediate Patch", "impact": "Remote Deserialization (Potential RCE)"}, "threat_synthesis": {"affected_systems": "Vendors affected include Alfresco: Activiti. The flaw is present in all releases up to version 7.19 and 8.8.0, inclusive. No affected version information beyond those in the CNAs is provided, so any deployment earlier than 7.20 or 8.8.1 should be considered vulnerable.", "description_and_impact": "The vulnerability resides in the Process Variable Serialization System of Alfresco Activiti, specifically the deserialize/createObjectInputStream method in SerializableType.java. An attacker can craft malicious serialized data that triggers the Java deserialization routine, which is marked as a flaw that allows remote exploitation. Based on the description, it is inferred that the flaw could enable remote code execution or other destructive actions on the host. The weakness is rooted in improper input validation and deserialization of untrusted data, aligning with CWE\u201120 and CWE\u2011502.", "risk_and_exploitability": "The CVSS score is 5.3 (Medium) with an EPSS score of less than 1% and no listing in the KEV catalog, which suggests a modest but non\u2011negligible risk. However, the description explicitly states that the exploit has been published and may be used, indicating that the vulnerability is actively exploited in the wild at a low probability. The attack vector is remote, presumably via ingestion of malicious process variables, and requires no local privileges."}}}}, "created": "2026-03-12T09:55:01.883827+00:00", "updated": "2026-03-20T15:36:23.997149+00:00", "vendors": ["alfresco", "alfresco$PRODUCT$activiti"]}