rootpwn

critical · CVSS v3 8.1 · CVSS v4 9.2

CVE-2026-92785

A critical Java deserialization vulnerability exists in the Angel machine learning framework versions up to and including 3.3.0 due to unval

Overview

A critical Java deserialization vulnerability exists in the Angel machine learning framework versions up to and including 3.3.0 due to unvalidated Kryo object processing. An unauthenticated remote attacker can submit crafted payloads to the master RPC endpoint via the setAlgoMetrics method, potentially leading to arbitrary class instantiation or memory exhaustion.

Description

Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint.

Impact

Exploitation impacts Integrity, Confidentiality, and Availability by allowing unauthenticated network actors to instantiate arbitrary classes (potentially leading to remote code execution) or cause a denial-of-service condition by exhausting memory on the coordinator node.

Remediation

Upgrade Angel to a patched release beyond version 3.3.0 that implements strict Kryo class registration or allowlist validation. If an immediate update is not feasible, restrict network access to the master RPC endpoint using firewalls, ACLs, or network segmentation to trusted internal hosts only.

Risk context

Rated as Critical severity with a CVSS v4 score of 9.2 (CVSS v3 8.1). EPSS scores are currently unassigned. High priority should be given to protecting exposed master RPC interfaces from untrusted network access.

Affected products

  • Angel through 3.3.0

Scores

Severity
critical
CVSS v2
7.6
CVSS v3
8.1
CVSS v4
9.2
EPSS
—

CVE-2026-92785 Deserialization Kryo Angel RPC RCE Denial of Service

← All CVEs

Related CVEs

critical

CVE-2026-86341

CVE‑2026‑86341 is a critical access‑control flaw that allows an attacker to bypass deployment approval checks by disabling strict policies after a deployment object has been altered. The vulnerability can silently enable unapproved code changes to reach production, compromising the integrity of the deployment pipeline.

View analysis

critical

CVE-2026-76460

A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

View analysis

critical

CVE-2026-92748

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicious files to sensitive locations for code execution.

View analysis

critical

CVE-2026-92749

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator session cookies to gain control of protected sites.

View analysis