CVE-2026-3967CWE-20CWE-502

Alfresco Activiti Process Variable Serialization System SerializableType.java createObjectInputStream deserialization

Medium · published March 12, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
38.6
In the wild
Unconfirmed
What it is

A flaw has been found in Alfresco Activiti up to 7.19/8.8.0. Affected by this issue is the function deserialize/createObjectInputStream of the file activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/variable/SerializableType.java of the component Process Variable Serialization System. This manipulation causes deserialization. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00456 · 38.6th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-502 · Deserialization of Untrusted Data
Published
2026-03-12T00:02Z
EPSS history
Timeline
  • 12 MAR 00:02Z
    Alfresco Activiti Process Variable Serialization System SerializableType.java createObjectInputStream deserialization
    cvelistv5