What is the CVSS score of CVE-2026-27369?

CVE-2026-27369 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of BoldThemes Celeste are affected by CVE-2026-27369?

A critical deserialization vulnerability in BoldThemes Celeste (versions through 1.3.6) allows attackers to inject malicious objects and potentially execute arbitrary code on affected systems.

How to fix or mitigate CVE-2026-27369?

Within 24 hours: Identify all systems running Celeste theme and isolate them or restrict external access if possible; enable enhanced logging and monitoring for suspicious activity. Within 7 days: Implement WAF rules to block malicious serialized object patterns and POST requests to vulnerable endpoints; consider disabling theme features that process user input if operationally feasible. Within 30 days: Evaluate alternative themes or wait for vendor patch release; conduct forensic analysis for any signs of compromise; plan controlled migration strategy if patch remains unavailable.

BoldThemes Celeste CVE-2026-27369

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-05 audit@patchstack.com

Deserialization

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in BoldThemes Celeste celeste allows Object Injection.This issue affects Celeste: from n/a through <= 1.3.6.

AnalysisAI

BoldThemes Celeste versions 1.3.6 and earlier are vulnerable to unsafe deserialization that enables arbitrary object injection attacks over the network without authentication. An attacker can exploit this to achieve remote code execution or other malicious operations on affected systems. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-502 (Deserialization of Untrusted Data). Affects BoldThemes Celeste celeste. Deserialization of Untrusted Data vulnerability in BoldThemes Celeste celeste allows Object Injection.This issue affects Celeste: from n/a through <= 1.3.6.