Unsafe deserialization vulnerabilities
Unsafe deserialization occurs when untrusted data is deserialized into live objects — in Java, .NET, PHP or Python — letting attackers instantiate gadget chains that end in code execution. Almost every advisory in this class is effectively an RCE, which its exploitation rate reflects.
Classification is assigned by the CSIRTS enrichment pipeline from the advisory text. The list below shows the latest advisories tagged unsafe deserialization, newest first, across national CERTs, vendor PSIRTs and vulnerability databases — exploited marks CVEs in the CISA KEV catalog.
Latest unsafe deserialization advisories
CVE-2026-9291 - Insecure Deserialization in Amazon Braket SDK Job Results Processing
USN-8642-1: c3p0 vulnerabilities
[NEW] [high] Bouncy Castle: Multiple vulnerabilities
AVEVA Enterprise SCADA
CVE-2026-65815: Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
CVE-2026-70321: Microsoft SharePoint Remote Code Execution Vulnerability
CVE-2026-65663: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2026-65658: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2026-65665: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2026-62912: Microsoft Exchange Server Denial of Service Vulnerability
CVE-2026-59124: Microsoft High Performance Computing (HPC) Pack Remote Code Execution Vulnerability
CVE-2026-50515: Azure Service Bus Remote Code Execution Vulnerability
CVE-2026-63639: Valkey: UAF in stream deserialization may lead to remote code execution
CVE-2026-69836: Microsoft Entra ID Remote Code Execution Vulnerability
CVE-2026-64901: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2026-66805: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2026-63514: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2026-66808: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2026-63516: Microsoft SharePoint Server Spoofing Vulnerability
CVE-2024-48063: In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing.
CVE-2023-28115: Snappy vulnerable to PHAR deserialization, allowing remote code execution
CISA Adds One Known Exploited Vulnerability to Catalog
CVE-2026-63077: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
NCSC-2026-0272 [1.00] [M/H] Vulnerabilities patched in JFrog Artifactory
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
NCSC-2026-0251 [1.00] [M/H] Vulnerabilities fixed in IBM Langflow OSS
NCSC-2026-0237 [1.01] [H/H] Vulnerabilities fixed in Microsoft Office
CVE-2026-58644: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
CVE-2026-58644: Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVE-2026-57433: Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record
CVE-2026-50517: Microsoft M365 Copilot Remote Code Execution Vulnerability
CVE-2026-50522: Microsoft SharePoint Remote Code Execution Vulnerability
DSA-6380-1 mediawiki - security update
AL26-015 - Critical vulnerability impacting Microsoft SharePoint Server – CVE-2026-45659
Delta Electronics DTM Soft
CVE-2026-45247: Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability
CVE-2023-21529: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
CVE-2026-20131: Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability
CVE-2026-20963: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
CVE-2025-26399: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
CVE-2017-1000353: Jenkins Remote Code Execution Vulnerability
CVE-2025-10035: Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability
CVE-2025-5086: Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability
CVE-2025-53690: Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
CVE-2024-8069: Citrix Session Recording Deserialization of Untrusted Data Vulnerability
CVE-2025-8875: N-able N-Central Insecure Deserialization Vulnerability
CVE-2025-53770: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
CVE-2025-42999: SAP NetWeaver Deserialization Vulnerability
Other vulnerability classes
New unsafe deserialization advisories, in your inbox. The daily briefing covers every advisory in this class the morning after it lands. Subscribe free — one email every morning after 06:00 UTC, one-click unsubscribe. Tracking specific products instead? Watch them from any product page and get alerted only when they ship a new advisory.