CVE-2026-3967: Alfresco Activiti Process Variable Serialization System SerializableType.java createObjectInputStream deserialization
A flaw has been found in Alfresco Activiti up to 7.19/8.8.0. Affected by this issue is the function deserialize/createObjectInputStream of the file activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/variable/SerializableType.java of the component Process Variable Serialization System. This manipulation causes deserialization. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3967?
CVE-2026-3967 is classified as a critical vulnerability due to the potential for remote code execution.
How do I fix CVE-2026-3967?
To fix CVE-2026-3967, upgrade Alfresco Activiti to version 8.8.1 or later.
What systems are affected by CVE-2026-3967?
CVE-2026-3967 affects Alfresco Activiti versions up to 8.8.0.
What type of vulnerability is CVE-2026-3967?
CVE-2026-3967 is a deserialization vulnerability found in the createObjectInputStream function.
Can CVE-2026-3967 be exploited remotely?
Yes, CVE-2026-3967 can be exploited remotely if the affected system is not properly secured.