Which versions of PRISMAproduction are affected by CVE-2026-3245?

Canon PRISMAproduction version 6.5 and earlier contains a high-severity remote code execution vulnerability enabling adjacent-network attackers to achieve unauthenticated full system compromise…

How to fix or mitigate CVE-2026-3245?

Within 24 hours, identify all Canon PRISMAproduction deployments and assess production criticality. Isolate affected systems to trusted internal networks only, restricting access from untrusted or adjacent networks through firewall rules. Within 7 days, deploy network-based monitoring to detect exploitation patterns targeting the deserialization attack surface, document current versions and configurations, and subscribe to Canon PSIRT notifications. By 30 days, evaluate whether vendor mitigations or workarounds have been published via advisory cp2026-007; assess migration to Canon PRISMAproduction 6.6 or later once vendor releases a patched version with a corresponding CVSS assessment.

PRISMAproduction CVE-2026-3245

Q: What is the CVSS score of CVE-2026-3245?

CVE-2026-3245 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-52012 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-03 f98c90f0-e9bd-4fa7-911b-51993f3571fd

GHSA-v9mp-gj7h-85r3

RCE Deserialization

7.7

CVSS 4.0 · Vendor: f98c90f0-e9bd-4fa7-911b-51993f3571fd

Severity by source

Vendor (f98c90f0-e9bd-4fa7-911b-51993f3571fd) PRIMARY

7.7 HIGH

CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Adjacent vector and high complexity from CVSS 4.0 source; no privileges or interaction required; scope unchanged as SC:N/SI:N/SA:N in 4.0 vector.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (f98c90f0-e9bd-4fa7-911b-51993f3571fd).

CVSS VectorVendor: f98c90f0-e9bd-4fa7-911b-51993f3571fd

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 00:27 vuln.today

CVE Published

Aug 03, 2026 - 00:16 cve.org

HIGH 7.7

DescriptionCVE.org

A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution.

AnalysisAI

Deserialization of untrusted data in Canon PRISMAproduction version 6.5 and earlier enables adjacent-network attackers to achieve arbitrary code execution without credentials. The CVSS 4.0 vector (AV:A/AC:H/PR:N) indicates exploitation requires physical or logical network adjacency and elevated attack complexity, but successful exploitation yields full confidentiality, integrity, and availability compromise of the host. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present; Canon PSIRT has published an advisory (cp2026-007) acknowledging the issue.

Technical ContextAI

PRISMAproduction is Canon's enterprise production-print workflow management platform, used in commercial and industrial printing environments to control and schedule high-volume print jobs. CWE-502 (Deserialization of Untrusted Data) describes a class of vulnerability where an application accepts serialized objects from an external source and reconstructs them without sufficient validation, allowing an attacker to supply a crafted payload that invokes arbitrary code during the deserialization process - a well-understood and highly impactful class of flaw seen in Java, .NET, and similar runtimes. The CVSS 4.0 vector specifies adjacent-network attack vector (AV:A), meaning the deserialization endpoint is exposed on a local network segment rather than the public internet, and high attack complexity (AC:H), indicating that successful exploitation likely requires knowledge of the platform's serialization format, a specific protocol interaction, or timing precision.

RemediationAI

Consult the Canon PSIRT advisory at https://psirt.canon/advisory-information/cp2026-007/ and the US Canon customer notice at https://www.usa.canon.com/about-us/to-our-customers/cpa2026-007-vulnerability-in-prismaproduction for vendor-confirmed patch guidance. No specific fixed version number was included in the data provided for this analysis, so a precise upgrade target cannot be independently confirmed here - reference the advisory directly for that information. Patch available per vendor advisory. As a compensating control pending patching, restrict network access to the PRISMAproduction server to only trusted print-operator workstations and management hosts via host-based or network firewall rules, exploiting the AV:A constraint inherent to this vulnerability; this reduces attack surface without affecting print job scheduling for authorized users. Additionally, audit VPN and remote-vendor access paths that may provide adjacent-network reachability to the PRISMAproduction host. Disabling or firewalling the specific deserialization-exposed service port, if identifiable via the vendor advisory, would be the most targeted compensating control but may impact platform functionality.