rootpwn

critical · CVSS v3 9.8 · CVSS v4 9.3

CVE-2026-93467

CVE-2026-93467 is an insecure deserialization flaw in OAKlouds by HGiga. Unauthenticated attackers can send crafted data to trigger arbitrar

Overview

CVE-2026-93467 is an insecure deserialization flaw in OAKlouds by HGiga. Unauthenticated attackers can send crafted data to trigger arbitrary code execution on the server, allowing full compromise of the affected services.

Description

The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.

Impact

Confidentiality: attackers can read sensitive data. Integrity: they can modify or delete data. Availability: they can crash or disrupt services. Defenders: system administrators and security teams must monitor for suspicious deserialization traffic.

Remediation

Apply the vendor-supplied patch that validates or sanitizes serialized input. If a patch is not available, disable remote deserialization endpoints or enforce strict input validation. Use a web application firewall to block suspicious payloads. Monitor logs for deserialization attempts.

Risk context

Critical severity with a CVSS v3 score of 9.8 indicates a high likelihood of exploitation. Immediate attention is recommended.

Affected products

  • HGiga OAKlouds

Scores

Severity
critical
CVSS v2
10
CVSS v3
9.8
CVSS v4
9.3
EPSS
—

insecure deserialization remote code execution critical HGiga OAKlouds patch mitigation

← All CVEs

Related CVEs

critical

CVE-2026-17086

The ShortPixel Image Optimizer plugin for WordPress contains a PHP Object Injection vulnerability in versions up to and including 6.5.5. It arises from the unsafe deserialization of untrusted input accessible to authenticated users with author-level privileges and above. While no native POP chain exists in the plugin itself, the presence of a compatible gadget chain from another theme or plugin could enable arbitrary file deletion, data retrieval, or code execution.

View analysis

critical

CVE-2026-81810

The All-in-One WP Migration and Backup plugin for WordPress fails to enforce proper capability checks on multiple AJAX actions. This oversight allows users with export privileges to import arbitrary site archives and escalate privileges to administrator under specific misconfigurations.

View analysis

critical

CVE-2026-85123

The Easy Form Builder plugin for WordPress fails to properly validate submitted values against stored configurations for certain form types. This oversight allows unauthenticated attackers to create unauthorized WordPress accounts on target sites where user registration has been explicitly disabled by the administrator. The flaw undermines core site access controls and exposes the installation to potential administrative takeover.

View analysis

critical

CVE-2026-85127

The VikBooking Hotel Booking Engine & PMS WordPress plugin before version 1.8.15 lacks proper file type restrictions and sanitization for unauthenticated live chat attachments. This flaw allows malicious users to store active content that executes within the browser context of an administrator reviewing the conversation.

View analysis