EUVD-2026-72462
GHSA-8jp6-hw6c-mjgf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable deserialization sink yields code execution (AV:N/AC:L/PR:N/UI:N); RCE gives full C/I/A within the application host scope.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Code Injection.
This issue affects CSM (Customer Service Management): through 07092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Remote code execution in Next4Biz CSM (Customer Service Management) up to build 07092026 allows unauthenticated attackers to inject and execute code by supplying crafted serialized objects that the application deserializes without validation (CWE-502). Reported by Turkey's national CSIRT (TR-CERT/USOM); the vendor was contacted but did not respond, and no fixed build is confirmed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to a Next4Biz CSM instance (through build 07092026) exposing an endpoint that accepts and deserializes untrusted serialized data; the crafted payload must reach that deserialization sink. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals point to a genuinely high-priority issue but with incomplete corroboration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis - the vendor was contacted by TR-CERT but did not respond, and no fixed build version is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Next4Biz CSM instances, document versions, and map network exposure; immediately remove CSM from public-facing access and restrict inbound connections to trusted networks via firewall; enable audit logging. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today