CVE-2026-82384: Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint
Apache Roller 6.1.5 has unauthenticated XML-RPC deserialization rated CVSS 9.8.
Apache disclosed CVE-2026-82384, a critical deserialization flaw in Apache Roller 6.1.5 with CVSS 3.1 9.8. The XML-RPC endpoint accepts vendor extension types that are deserialized while parsing a request, before authentication. An unauthenticated remote attacker can therefore cause deserialization of attacker-controlled bytes, with high impact on confidentiality, integrity, and availability. The advisory does not say the flaw is being exploited.
- Unauthenticated remote deserialization before authentication
- XML-RPC endpoint accepts vendor extension types
- Affects Apache Roller 6.1.5
- CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact
- No in-the-wild exploitation stated
- CVEs
- CVE-2026-82384
- Vendors
- Apache
- Products
- Apache Roller
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82384 | Unauthenticated deserialization RCE in Apache Roller 6.1.5 | 9.8 | — |
From the original article
Posted by David M. Johnson on Sep 25 Severity: Critical CVSS 3. 1: 9.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.