CVE-2023-54398
Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.64%
- CWE
- CWE-502
- Published
- 2026-09-15
- Last modified
- 2026-09-15
Affected products
- Yonyou U8 Cloud
- Yonyou U8 Cloud
- Yonyou U8 Cloud
- Yonyou U8 Cloud
- Yonyou U8 Cloud
- Yonyou U8 Cloud
- Yonyou U8 Cloud
- Yonyou U8 Cloud
Weakness type
Related vulnerabilities
- CVE-2026-87719 — Deserialization of Untrusted Data in GitLab
- CVE-2026-72649 — Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution
- CVE-2026-82222 — WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
- CVE-2026-70416 — Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability. An unauthentica
- CVE-2026-17061 — Deserialization of Untrusted Data Vulnerability in SIMULIA Execution Engine from Release 2023 through Release 2026
- CVE-2026-4703 — WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission
- CVE-2026-20307 — Cisco Identity Services Engine Remote Code Execution Vulnerability
- CVE-2026-12650 — A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated