SPLWare esProc CVE-2026-75987

Q: What is the CVSS score of CVE-2026-75987?

CVE-2026-75987 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-62221 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-08-19 VulDB

GHSA-3r2x-33h3-cm5q

Java Deserialization Esproc

6.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network socket is directly reachable with no authentication per CVSS 4.0 PR:N; scope unchanged as subsequent-system metrics are all N; C/I/A held at Low matching 4.0 VC/VI/VA absent confirmed gadget-chain RCE.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 05:30 vuln.today

DescriptionCVE.org

A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/parallel/SocketData.java. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible.

AnalysisAI

Unsafe Java deserialization in SPLWare esProc through version 20260507 exposes a network-accessible socket endpoint to remote, unauthenticated object injection. The vulnerable class ObjectInputStream.readUnshared in SocketData.java processes attacker-controlled serialized data without validation, enabling arbitrary object graph instantiation. No public exploit or CISA KEV listing is confirmed at time of analysis, but the unauthenticated network vector and absence of complexity barriers make this a credible remote attack surface requiring prompt patching.

Technical ContextAI

esProc is a Java-based distributed data processing and analytics engine produced by SPLWare. The vulnerability resides in src/main/java/com/scudata/parallel/SocketData.java, specifically in the use of ObjectInputStream.readUnshared() - a Java standard library method that deserializes a new, non-shared object from a raw byte stream without type-safe validation or allowlisting. CWE-502 (Deserialization of Untrusted Data) describes the root cause: the application accepts a serialized object payload from the network and reconstructs it into a live Java object without verifying its class or contents. Depending on the classes available on esProc's classpath - potentially including gadget-chain-enabling libraries such as Apache Commons Collections, Spring, or similar - an attacker may be able to trigger arbitrary method invocations during deserialization. The affected CPE is cpe:2.3:a:splware:esproc:*:*:*:*:*:*:*:* covering all versions through 20260507.

RemediationAI

The primary remediation is to upgrade esProc beyond build 20260507 once SPLWare releases a patched version; however, no specific fixed release version has been independently confirmed from the available data - monitor the official GitHub repository (https://github.com/SPLWare/esProc/) and issue #67 for a tagged patched release. As an immediate compensating control, restrict network access to the esProc socket port at the firewall or host level to trusted internal hosts only, eliminating the unauthenticated remote attack surface; this is the highest-leverage interim mitigation and should be applied immediately if upgrading is not yet possible. Additionally, audit the esProc classpath for known gadget-chain libraries (Apache Commons Collections, Spring Core, Groovy, etc.) and remove any that are not operationally required, as their presence determines whether the deserialization primitive can be escalated to code execution. If esProc supports a configuration to disable or restrict the parallel socket interface, disable it when not in use. No vendor advisory with explicit guidance has been identified at time of analysis.