Which versions of OAKlouds Custom Page are affected by EUVD-2026-82641?

HGiga OAKlouds Custom Page module (versions 2.0, 3.0, and 4.0 builds below 26) is affected by a critical unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary…. A patch is available.

How to fix or mitigate EUVD-2026-82641?

Within 24 hours, inventory all HGiga OAKlouds deployments to identify instances running Custom Page module builds below 26, and where immediate patching is not possible, restrict network access to the Custom Page endpoint to trusted IPs only; apply the vendor-released patch by upgrading to build 26 or later as soon as feasible. Within 7 days, ensure that all identified affected instances have been upgraded to build 26 or later, verify patch installation, and enable enhanced logging and monitoring for exploitation attempts on the Custom Page endpoint. Within 30 days, conduct a comprehensive security review of all OAKlouds installations to confirm no unauthorized access occurred, validate that no other vulnerable components exist, and implement network segmentation or a web application firewall to protect similar deserialization endpoints from untrusted networks.

OAKlouds Custom Page EUVD-2026-82641

Q: What is the CVSS score of EUVD-2026-82641?

EUVD-2026-82641 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-93467 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-09-18 twcert

GHSA-7qh3-jh73-mv66

RCE Deserialization Hgiga Oaklouds Custom Page 2 0 Oaklouds Custom Page 3 0 Oaklouds Custom Page 4 0

9.3

CVSS 4.0 · Vendor: twcert

Severity by source

Vendor (twcert) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated, network-facing, low-complexity deserialization yielding code execution gives AV:N/AC:L/PR:N/UI:N with full C/I/A impact; scope unchanged as code runs in the app process.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (twcert).

CVSS VectorVendor: twcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 18, 2026 - 03:20 vuln.today

Patch available

Sep 18, 2026 - 03:01 EUVD

CVE Published

Sep 18, 2026 - 02:17 cve.org

CRITICAL 9.3

DescriptionCVE.org

The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.

AnalysisAI

Unauthenticated remote code execution affects HGiga's OAKlouds Custom Page module in the 2.0, 3.0 and 4.0 lines at builds below 26, where an attacker who can reach the Custom Page endpoint can submit malicious serialized content and have it deserialized into arbitrary code running with the web service's privileges. The CVSS 4.0 score of 9.3 reflects the worst case for an unauthenticated network attacker (PR:N, UI:N, AT:N, high confidentiality, integrity and availability impact on the vulnerable system), and the practical limiter is exposure - whether the affected instance is reachable from untrusted networks - rather than any technical precondition. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No special conditions - remote unauthenticated exploitation against network-reachable OAKlouds Custom Page instances (versions 2.0/3.0/4.0 prior to fix version 26). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuinely high-priority vulnerability, not a high-CVSS-but-low-risk artifact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade OAKlouds Custom Page 2.0, 3.0 and 4.0 to build 26 or later, which is the fixed version boundary recorded in EUVD (all versions below 26 are listed as affected); patch availability is confirmed by the vendor and the details are documented in the TW-CERT advisories at https://www.twcert.org.tw/en/cp-139-11211-d2aa9-2.html and https://www.twcert.org.tw/tw/cp-132-11210-11cb0-1.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all HGiga OAKlouds deployments to identify instances running Custom Page module builds below 26, and where immediate patching is not possible, restrict network access to the Custom Page endpoint to trusted IPs only; apply the vendor-released patch by upgrading to build 26 or later as soon as feasible. …

Threat intelligence, references, and detailed analysis are available after sign-in.