EUVD-2026-94219
GHSA-2v3v-q9xj-82fm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network deserialization (AV:N/AC:L/PR:N/UI:N); arbitrary code execution yields full C/I/A impact, so A:H despite the input vector's VA:N.
Primary rating from Vendor (CERT-In).
CVSS VectorVendor: CERT-In
Lifecycle Timeline
2DescriptionCVE.org
This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system.
Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code, manipulate application data or perform other unintended actions on the targeted system.
AnalysisAI
Unauthenticated remote code execution in Manacle Multi-Tenant ERP allows attackers to execute arbitrary code or manipulate application data through unsafe deserialization of user-controlled input (CWE-502). The vulnerability (CVE-2026-107104) is rated critical with a CVSS 4.0 score of 9.3 and requires no privileges or user interaction to exploit (PR:N/UI:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the vulnerable deserialization functionality be network-reachable and that the ERP accept and deserialize externally supplied data - the description names no authentication, feature toggle, or non-default configuration requirement, consistent with PR:N/UI:N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority vulnerability on technical merits. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch is identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all internet-facing and internal Manacle Multi-Tenant ERP instances, remove or restrict direct network access where feasible, enforce strict firewall and VPN controls, enable detailed logging, and deploy WAF or IPS rules to block unsafe deserialization patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Multi Tenant Erp System
View allUnauthenticated remote code execution in Manacle Technologies' Multi-Tenant ERP System allows attackers to upload arbitr
Unauthenticated SQL injection in the Manacle Multi-Tenant ERP System's API endpoint allows remote attackers to inject ar
Unauthenticated authentication bypass in Manacle Technologies' Multi-Tenant ERP System lets a remote attacker forge paym
Source code disclosure in Manacle Technologies' Multi-Tenant ERP System allows unauthenticated remote attackers to recon
Sensitive-data exposure in Manacle Technologies' Multi-Tenant ERP System allows an unauthenticated remote attacker to re
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today