SOY CMS EUVD-2026-67579

Exploitation requires network reachability to a SOY CMS endpoint that deserializes untrusted input; per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) there are no special conditions - remote unauthenticated exploitation is feasible against default configurations of SOY CMS, with no user interaction and no authentication needed. The practical limiting factors are that the attacker must reach the vulnerable deserialization sink over the network and that successful arbitrary code execution runs only at the web server's privilege level (SC:N/SI:N/SA:N, i.e., no automatic scope change to other systems), so containment depends on how the web server account is privileged.

The signals are strongly consistent and point to a genuine priority rather than an inflated CVSS: the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) describes remote, unauthenticated, low-complexity exploitation with full compromise potential, and the CWE-502 deserialization class is historically highly exploitable once a gadget chain is found. Tempering that, no EPSS score, KEV entry, or public proof-of-concept was provided, so widespread automated exploitation is not yet evidenced - the current status is 'no public exploit identified at time of analysis.' Because exploitation needs no authentication or user interaction and yields web-server-privilege code execution, any organization running an internet-facing SOY CMS instance should treat this as urgent and patch promptly, while noting that the absence of KEV/EPSS data means the real-world exploitation likelihood is inferred from the vulnerability class rather than confirmed telemetry.

A remote attacker locates an internet-facing SOY CMS instance and sends a crafted request containing a malicious PHP-serialized object to a parameter that the application deserializes. The object triggers a POP gadget chain during unserialization, causing arbitrary code to run as the web server user, after which the attacker plants a webshell or pivots into the host. No authentication or user interaction is required and no public exploit code was identified at time of analysis.