Which versions of SOY CMS are affected by CVE-2026-78032?

SOY CMS contains a critical unauthenticated remote code execution vulnerability (CVE-2026-78032, CVSS 9.3) allowing attackers to execute arbitrary code with web server privileges without…

How to fix or mitigate CVE-2026-78032?

Within 24 hours, conduct inventory of all SOY CMS installations and assess network exposure; immediately isolate or block internet-facing instances at the perimeter. Within 7 days, implement network access controls restricting SOY CMS to trusted networks only, disable non-mission-critical instances, and deploy monitoring for exploitation attempts including anomalous deserialization activity. Within 30 days, establish ongoing communication with SOY CMS vendor regarding patch availability and timelines, plan upgrade to patched version upon release, and maintain documented mitigation status for all systems unable to be patched.

SOY CMS CVE-2026-78032

Q: What is the CVSS score of CVE-2026-78032?

CVE-2026-78032 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-67579 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-28 jpcert

GHSA-69j4-4rqg-85f9

RCE Deserialization Soy Cms

9.3

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote, unauthenticated, low-complexity deserialization yielding code execution at web-server privilege justifies AV:N/AC:L/PR:N/UI:N with full C/I/A impact; scope unchanged as impact stays within the web server account.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 28, 2026 - 08:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 28, 2026 - 08:22 vuln.today

cvss_changed

CVSS changed

Aug 28, 2026 - 08:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Aug 28, 2026 - 08:06 vuln.today

CVE Published

Aug 28, 2026 - 06:11 cve.org

CRITICAL 9.8

DescriptionCVE.org

SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege.

AnalysisAI

Unauthenticated remote code execution in SOY CMS arises from unsafe deserialization of attacker-controlled data (CWE-502), letting a remote attacker run arbitrary code with the privileges of the web server process. The flaw was coordinated through JPCERT/CC and JVN (JVN04485476) and carries a CVSS 4.0 base score of 9.3. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires network reachability to a SOY CMS endpoint that deserializes untrusted input; per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) there are no special conditions - remote unauthenticated exploitation is feasible against default configurations of SOY CMS, with no user interaction and no authentication needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are strongly consistent and point to a genuine priority rather than an inflated CVSS: the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) describes remote, unauthenticated, low-complexity exploitation with full compromise potential, and the CWE-502 deserialization class is historically highly exploitable once a gadget chain is found. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade SOY CMS to the fixed release identified in the vendor advisory at https://saitodev.co/article/7105 and the JPCERT/CC coordination note at https://jvn.jp/en/jp/JVN04485476/; no vendor-released patch version was provided in the structured input, so consult those advisories for the exact fixed version and do not rely on an assumed number. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, conduct inventory of all SOY CMS installations and assess network exposure; immediately isolate or block internet-facing instances at the perimeter. …

Threat intelligence, references, and detailed analysis are available after sign-in.