CVE-2026-78032

CVE-2026-78032 is a deserialization of untrusted data flaw (CWE-502) in SOY CMS, a PHP-based content management system. The vulnerable code accepts and unserializes attacker-controlled input over the network, and the CVSS 4.0 vector (network attack, low complexity, no privileges or user interaction required) indicates the flaw can be reached without authentication. By supplying a crafted serialized payload, an attacker can achieve arbitrary code execution on the server with the privileges of the web server user. Any organization running an affected SOY CMS deployment, particularly internet-facing sites, is exposed until a fixed version is applied. No public proof-of-concept, KEV listing, or confirmed exploitation is known at this time, and EPSS puts the 30-day exploitation probability at only about 0.4%.

What to do: Check the vendor's release notes and the JPCERT/CC advisory to identify affected and fixed SOY CMS versions, then upgrade to the patched release as soon as it is available. Until patching, minimize exposure by restricting administrative or unauthenticated endpoints that accept serialized input (for example via WAF rules or network access controls) and review web server logs for anomalous serialized payloads or unexpected code execution under the web server account.