EUVD-2026-35992
GHSA-w776-2rqx-9pjh
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (symantec) · only source for this CVE.
CVSS VectorVendor: symantec
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could potentially deserialize arbitrary objects. This vulnerability could lead to broken security expectations or remote code execution.
AnalysisAI
Insecure deserialization in Broadcom Layer 7 API Gateway 11.2.1 exposes organizations to remote code execution or broken security control enforcement when an adversary can intercept and tamper with traffic between a client application and the gateway. The CVSS 4.0 vector assigns High subsequent-system confidentiality impact (SC:H), reflecting the gateway's privileged position as a broker to downstream backend services - meaning a successful exploit can cascade beyond the gateway itself. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the RCE potential and architectural sensitivity of an API gateway make this a meaningful priority for affected deployments.
Technical ContextAI
Broadcom Layer 7 API Gateway (CPE: cpe:2.3:a:broadcom:layer_7_api_gateway:*:*:*:*:*:*:*:*) is an enterprise API management and security enforcement platform. The root cause is CWE-502 (Deserialization of Untrusted Data): the gateway processes serialized object data arriving from client requests without sufficient integrity validation, allowing attacker-controlled payloads to be deserialized on the server side. Deserialization vulnerabilities of this class typically exploit Java or similar runtime gadget chains - when a malicious object graph is deserialized, it can trigger arbitrary method calls during object reconstruction, leading to OS command execution or manipulation of application state. The attack is positioned at the network transport layer: an adversary capable of intercepting the client-to-gateway communication path can substitute or inject serialized payloads, which the gateway then processes. The CVSS 4.0 metric SC:H underscores that the gateway's trust relationships with backend systems amplify the downstream blast radius well beyond the gateway process itself.
RemediationAI
Consult the Broadcom security advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37631 for the vendor-confirmed patched version; an exact fix version number was not independently extractable from the available source data, so the patch version is not confirmed here and must be taken directly from the advisory. As a compensating control while patching is scheduled, enforce mutual TLS (mTLS) between all client applications and the API Gateway to eliminate the intercept-and-tamper attack surface - this directly addresses the AC:H MITM precondition by ensuring the communication channel cannot be tampered with by a passive interceptor. Additionally, restrict network-level access to the API Gateway listener ports to only known, authorized client IP ranges, reducing the pool of hosts capable of establishing an interception position. Note that mTLS enforcement may require client certificate provisioning across all consuming applications, which introduces operational overhead. Additional context and scoring are available at https://vuldb.com/vuln/370124.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today