What is the CVSS score of EUVD-2026-18532?

EUVD-2026-18532 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Groupoffice are affected by EUVD-2026-18532?

Group-Office CRM versions prior to 6.8.156, 25.0.90, and 26.0.12 contain a critical remote code execution vulnerability exploitable by authenticated users with low-level access, enabling arbitrary…. A patch is available.

How to fix or mitigate EUVD-2026-18532?

Within 24 hours: Inventory all Group-Office CRM deployments and document current versions. Within 7 days: Upgrade to patched versions (6.8.156, 25.0.90, or 26.0.12 depending on deployment branch) and verify patch installation. Within 30 days: Conduct access review of Group-Office user accounts, implement principle of least privilege for system accounts, and enable enhanced logging on deserialization events.

Groupoffice EUVD-2026-18532

| CVE-2026-34838 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-04-02 GitHub_M

Microsoft Deserialization RCE Groupoffice

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:46 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.8.156,26.0.12,25.0.90

EUVD ID Assigned

Apr 02, 2026 - 19:31 euvd

EUVD-2026-18532

Analysis Generated

Apr 02, 2026 - 19:31 vuln.today

CVE Published

Apr 02, 2026 - 19:15 nvd

CRITICAL 9.9

DescriptionCVE.org

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.156, 25.0.90, and 26.0.12, a vulnerability in the AbstractSettingsCollection model leads to insecure deserialization when these settings are loaded. By injecting a serialized FileCookieJar object into a setting string, an authenticated attacker can achieve Arbitrary File Write, leading directly to Remote Code Execution (RCE) on the server. This issue has been patched in versions 6.8.156, 25.0.90, and 26.0.12.

AnalysisAI

Remote Code Execution in Group-Office enterprise CRM via insecure deserialization allows authenticated attackers to write arbitrary files and execute code on the server. Affects all versions prior to 6.8.156, 25.0.90, and 26.0.12 across multiple product branches. CVSS 9.9 (Critical) with network-based attack vector requiring only low-privileged authentication. No public exploit identified at time of analysis, though the technical details in the GitHub Security Advisory provide sufficient impleme

Technical ContextAI

This vulnerability exploits PHP's insecure deserialization mechanism (CWE-502) in Group-Office's AbstractSettingsCollection model. When application settings are loaded from storage, the model deserializes user-controllable data without proper validation. An authenticated attacker can inject a specially-crafted serialized PHP object-specifically a FileCookieJar object from the Guzzle HTTP library or similar components-into a settings field. During deserialization, PHP's magic methods (__wakeup, __destruct) are automatically invoked, allowing the attacker to control file write operations. By manipulating the FileCookieJar object's properties, the attacker can write arbitrary content to arbitrary filesystem locations, including executable PHP code in web-accessible directories. This insecure deserialization pattern is particularly dangerous in PHP applications because it enables attackers to chain together gadgets from existing application code or dependencies to achieve code execution. The vulnerability affects Group-Office's enterprise CRM and groupware platform (cpe:2.3:a:intermesh:groupoffice), which is used for customer relationship management, email, calendaring, and collaboration.

RemediationAI

Vendor-released patches are available across all affected version branches. Organizations should immediately upgrade to Group-Office version 6.8.156 (for 6.8.x branch users), version 25.0.90 (for 25.0.x branch users), or version 26.0.12 (for 26.0.x branch users). Release packages are available at the official GitHub repository: https://github.com/Intermesh/groupoffice/releases/tag/v6.8.156, https://github.com/Intermesh/groupoffice/releases/tag/v25.0.90, and https://github.com/Intermesh/groupoffice/releases/tag/v26.0.12. Before upgrading production systems, review the complete security advisory at https://github.com/Intermesh/groupoffice/security/advisories/GHSA-h22j-frrf-5vxq for any version-specific migration notes or breaking changes. As a temporary risk reduction measure while testing patches, organizations can restrict network access to Group-Office instances using firewall rules or VPN requirements, and audit user accounts to remove unnecessary low-privileged access. However, access controls are not a substitute for patching, as any authenticated user can exploit this vulnerability. Post-patch, administrators should review application logs for suspicious settings modifications and scan web-accessible directories for unexpected PHP files that may indicate prior exploitation.