What is the CVSS score of CVE-2026-23544?

CVE-2026-23544 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-23544?

Within 24 hours: Inventory all systems running Valenti and identify which are internet-facing or process untrusted data; implement network segmentation to restrict access. Within 7 days: Deploy WAF rules to detect and block suspicious deserialization payloads; disable Valenti if business-critical and not essential. Within 30 days: Contact vendor for patch availability and timeline; evaluate alternative solutions or upgrade to patched versions when released; conduct security assessment of affected systems for signs of compromise.

CVE-2026-23544

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-02-19 audit@patchstack.com

Deserialization

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

CVE Published

Feb 19, 2026 - 09:16 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in codetipi Valenti valenti allows Object Injection.This issue affects Valenti: from n/a through <= 5.6.3.5.

AnalysisAI

Unsafe deserialization in Codetipi Valenti through version 5.6.3.5 enables authenticated attackers to inject arbitrary objects and achieve remote code execution. An attacker with valid credentials can exploit this vulnerability to execute malicious commands with the privileges of the affected application. No patch is currently available.

Technical ContextAI

Classified as CWE-502 (Deserialization of Untrusted Data). Affects codetipi Valenti valenti. Deserialization of Untrusted Data vulnerability in codetipi Valenti valenti allows Object Injection.This issue affects Valenti: from n/a through <= 5.6.3.5.