What is the CVSS score of CVE-2026-24892?

CVE-2026-24892 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of PHP are affected by CVE-2026-24892?

openITCOCKPIT monitoring tool versions 5.3.1 and earlier are vulnerable to unsafe PHP deserialization attacks that could allow unauthorized code execution.. A patch is available.

Is there a public PoC exploit available for CVE-2026-24892?

Yes, a public proof-of-concept exploit is available for CVE-2026-24892. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-24892?

Within 24 hours: Identify all systems running openITCOCKPIT Community Edition 5.3.1 or earlier and assess exposure. Within 7 days: Apply available vendor patch to all affected instances and validate successful deployment. Within 30 days: Conduct post-patch security testing and review access logs for signs of exploitation.

PHP CVE-2026-24892

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-02-20 security-advisories@github.com

PHP Prometheus RCE Deserialization Openitcockpit

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

PoC Detected

Mar 02, 2026 - 14:56 vuln.today

Public exploit code

Patch released

Mar 02, 2026 - 14:56 nvd

Patch available

CVE Published

Feb 20, 2026 - 21:19 nvd

HIGH 7.5

DescriptionGitHub Advisory

openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. openITCOCKPIT Community Edition 5.3.1 and earlier contains an unsafe PHP deserialization pattern in the processing of changelog entries. Serialized changelog data derived from attacker-influenced application state is unserialized without restricting allowed classes. Although no current application endpoint was found to introduce PHP objects into this data path, the presence of an unrestricted unserialize() call constitutes a latent PHP object injection vulnerability. If future code changes, plugins, or refactors introduce object values into this path, the vulnerability could become immediately exploitable with severe impact, including potential remote code execution.

AnalysisAI

Unsafe PHP deserialization in openITCOCKPIT Community Edition 5.3.1 and earlier allows authenticated attackers to inject malicious serialized objects through changelog entries, with public exploit code available. While no current attack path has been identified, an unrestricted unserialize() call creates a latent remote code execution vulnerability that could be exploited if future code changes introduce exploitable object types into the deserialization path. Authenticated access is required, but the HIGH severity rating reflects the potential for complete system compromise if this latent flaw is activated.

Technical ContextAI

Classified as CWE-502 (Deserialization of Untrusted Data). Affects Openitcockpit. openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. openITCOCKPIT Community Edition 5.3.1 and earlier contains an unsafe PHP deserialization pattern in the processing of changelog entries. Serialized changelog data derived from attacker-influenced application state is unserialized without restricting allowed classes. Although no current application endpoint was found to introduce PHP objects into this data path, the presence