CVE-2026-107104CWE-502insecure-deserialization

CVE-2026-107104

published October 7, 2026

CVSS
9.3
EPSS
0%
Percentile
35.5
In the wild
Unconfirmed
What it is

This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system.

Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code, manipulate application data or perform other unintended actions on the targeted system.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00423 · 35.5th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-10-07T13:17Z
References (1)
EPSS history
Timeline
  • 08 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 07 OCT 08:25Z
    Unsafe Deserialization Vulnerability in Manacle Technologies ERP System
    cvelistv5