What is the CVSS score of CVE-2026-32355?

CVE-2026-32355 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Jetengine are affected by CVE-2026-32355?

Crocoblock JetEngine versions before 3.8.4.1 contain a critical deserialization flaw that allows authenticated users with standard website access to execute arbitrary code and take control of…. A patch is available.

How to fix or mitigate CVE-2026-32355?

Within 24 hours: Identify all WordPress instances running Crocoblock JetEngine and document current versions via wp-cli or admin dashboard. Within 7 days: Update all JetEngine installations to version 3.8.4.1 or later via WordPress plugin manager or manual upload; test on staging environment first. Within 30 days: Audit user access logs for JetEngine-related activity post-update; review user role assignments and revoke unnecessary authenticated access.

Jetengine CVE-2026-32355

EUVD-2026-11844 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-13 Patchstack

Deserialization Jetengine

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:22 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.8.4.1

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11844

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Object Injection.This issue affects JetEngine: from n/a through < 3.8.4.1.

AnalysisAI

Crocoblock JetEngine versions below 3.8.4.1 are vulnerable to unsafe deserialization of untrusted data, enabling authenticated attackers to inject malicious objects and achieve arbitrary code execution. An attacker with user-level access can exploit this vulnerability without user interaction to fully compromise the affected system. No patch is currently available for this vulnerability.

Technical ContextAI

Insecure deserialization occurs when untrusted data is used to reconstruct objects, allowing attackers to manipulate serialized data to execute arbitrary code. This vulnerability is classified as Deserialization of Untrusted Data (CWE-502).

RemediationAI

Avoid deserializing untrusted data. Use safe serialization formats (JSON instead of native serialization). Implement integrity checks on serialized data.