CVE-2026-76834CWE-502insecure-deserialization

CVE-2026-76834

High · published September 17, 2026

CVSS v3.1

8.1

EPSS

Percentile

57.7

In the wild

Unconfirmed

What it is

b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array object check in param_check_serialized_array() fails to reject payloads with negative integer array keys. Unauthenticated attackers can submit crafted serialized PHP objects via POST requests to htsrv/call_plugin.php that bypass validation and reach unserialize(), instantiating arbitrary PHP objects with attacker-chosen properties that may enable code execution if suitable POP gadget chains exist.

The record

Technical detail

CVSS v3.1: 8.1 · HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: 9.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00847 · 57.7th percentile
Weakness: CWE-502 · Deserialization of Untrusted Data
Published: 2026-09-17T20:17Z

References (9)

EPSS history

Timeline

19 SEP 03:54Z
EPSS moved — → 1%
epss
17 SEP 15:16Z
b2evolution CMS 6.7.8 through 7.2.5 Object Injection via Negative Integer Array Key
cvelistv5