CVE-2026-37719CWE-502insecure-deserialization

CVE-2026-37719

Critical · published October 5, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
54.2
In the wild
Unconfirmed
What it is

An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00741 · 54.2th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-10-05T20:17Z
References (3)
http://dormakaba.com · [email protected]https://assets.ctfassets.net/y0dk4vkszqeh/7nkbvO1MxCI5nOhzwDMCF9/173fdc4ceb38e4b9b853f79df6ad44d0/DKSA-26-31-031_evolo_Service_1.pdf · [email protected]https://www.dormakabagroup.com/en/security-advisories · [email protected]
EPSS history
Timeline
  • 07 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 05 OCT 00:00Z
    An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component
    cvelistv5