Esproc
Monthly
Unsafe Java deserialization in SPLWare esProc through version 20260507 exposes a network-accessible socket endpoint to remote, unauthenticated object injection. The vulnerable class `ObjectInputStream.readUnshared` in `SocketData.java` processes attacker-controlled serialized data without validation, enabling arbitrary object graph instantiation. No public exploit or CISA KEV listing is confirmed at time of analysis, but the unauthenticated network vector and absence of complexity barriers make this a credible remote attack surface requiring prompt patching.
Unsafe Java deserialization in SPLWare esProc through version 20260507 exposes a network-accessible socket endpoint to remote, unauthenticated object injection. The vulnerable class `ObjectInputStream.readUnshared` in `SocketData.java` processes attacker-controlled serialized data without validation, enabling arbitrary object graph instantiation. No public exploit or CISA KEV listing is confirmed at time of analysis, but the unauthenticated network vector and absence of complexity barriers make this a credible remote attack surface requiring prompt patching.