CVE-2026-25873CWE-502

OmniGen2-RL Reward Server Unsafe Deserialization RCE

Critical · published March 18, 2026

CVSS v4.0
9.3
EPSS
2%
Percentile
77.1
In the wild
Unconfirmed
What it is

OmniGen2-RL contains an unauthenticated remote code execution vulnerability in the reward server component that allows remote attackers to execute arbitrary commands by sending malicious HTTP POST requests. Attackers can exploit insecure pickle deserialization of request bodies to achieve code execution on the host system running the exposed service.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01709 · 77.1th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-03-18T20:47Z
EPSS history
Timeline
  • 18 MAR 20:47Z
    OmniGen2-RL Reward Server Unsafe Deserialization RCE
    cvelistv5