Which versions of ZAP ViewState are affected by CVE-2026-57527?

The OWASP ZAP ViewState add-on (versions prior to v4) is vulnerable to remote code execution through unsafe Java deserialization.. A patch is available.

How to fix or mitigate CVE-2026-57527?

Within 24 hours: Conduct inventory of all OWASP ZAP deployments and identify instances running ViewState add-on versions before v4. Within 7 days: Upgrade to ViewState v4 or disable the ViewState add-on entirely. Within 30 days: Verify upgrades are complete across all infrastructure and update security testing procedures to reflect the change (v4 disables JSF support).

ZAP ViewState CVE-2026-57527

Q: What is the CVSS score of CVE-2026-57527?

CVE-2026-57527 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-39777 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-26 disclosure@vulncheck.com

GHSA-grq4-7pwr-9rmp

RCE Java Deserialization

8.7

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Attacker-controlled proxied server reaches the victim over the network (AV:N) with no privileges (PR:N), but the operator must open the ViewState panel (UI:R), yielding full code-execution impact (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 26, 2026 - 16:16 EUVD

Source Code Evidence Fetched

Jun 26, 2026 - 15:51 vuln.today

Analysis Generated

Jun 26, 2026 - 15:51 vuln.today

DescriptionCVE.org

Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter. The JSFViewState.decode() method base64-decodes the ViewState value and passes it directly to ObjectInputStream.readObject() without a deserialization filter, allowlist, or type restriction, causing the malicious object to be deserialized within the ZAP JVM when the Desktop UI renders the ViewState panel.

AnalysisAI

Arbitrary code execution in the OWASP ZAP ViewState add-on (versions before 4) lets a malicious or attacker-controlled proxied web server compromise the security tester's own ZAP instance. By embedding a crafted serialized Java object in the javax.faces.ViewState response parameter, an attacker triggers unsafe Java deserialization inside the ZAP JVM the moment the operator views the ViewState panel in the Desktop UI. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor has published an advisory and shipped a fix (viewstate-v4) that disables JSF support entirely.

Technical ContextAI

The flaw is a classic CWE-502 unsafe deserialization in the JSF (JavaServer Faces) ViewState handling path of ZAP's optional viewstate add-on. JSF applications serialize component-tree state into the javax.faces.ViewState field; ZAP's add-on attempts to decode this for inspection. JSFViewState.decode() base64-decodes the attacker-supplied value and passes the bytes straight to java.io.ObjectInputStream.readObject() with no look-ahead deserialization filter, class allowlist, or type restriction. With common gadget libraries on the classpath, readObject() on attacker-controlled bytes is a well-known route to remote code execution. Critically, the vulnerable component is the security tooling itself (the ZAP client/proxy), not the target web application - the trust boundary is inverted because ZAP is expected to safely parse hostile traffic.

RemediationAI

Vendor-released patch: ZAP viewstate add-on version 4 (viewstate-v4); update the add-on via the ZAP Marketplace to version 4 or later, which removes JSF ViewState support entirely (commit ac6c3f9 comments out registration of the javax.faces.ViewState parameter and changes the add-on to an 'ASP ViewState Decoder and Editor' only). If immediate updating is not possible, compensating controls are to uninstall or disable the viewstate add-on (trade-off: loses ASP ViewState decoding too), or operationally avoid opening the ViewState panel when proxying untrusted or unknown JSF targets (trade-off: relies on operator discipline and is not a technical control). See the vendor advisory https://www.zaproxy.org/blog/2026-06-24-java-deserialization-vulnerability-in-zap-viewstate-addon/ and PR https://github.com/zaproxy/zap-extensions/pull/7481 for fix details.