CVE-2023-54398CWE-502insecure-deserialization

CVE-2023-54398

Critical · published September 15, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
50.1
In the wild
Unconfirmed
What it is

Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00642 · 50.1th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-09-15T21:17Z
References (6)
https://avd.aliyun.com/detail?id=AVD-2023-1686894 · [email protected]https://blog.csdn.net/qq_41904294/article/details/134277353 · [email protected]https://cn-sec.com/archives/2182384.html · [email protected]https://security.yonyou.com/#/noticeInfo?id=400 · [email protected]https://www.vulncheck.com/advisories/yonyou-u8-cloud-java-deserialization-rce-via-filemanageservlet · [email protected]https://www.yonyou.com/Global/ · [email protected]
EPSS history
Timeline
  • 17 SEP 03:19Z
    EPSS moved — → 1%
    epss
  • 15 SEP 16:43Z
    Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet
    cvelistv5