[0day-rubbish] Accurate Online Private Cloud on-prem (current) Unauthenticated Hessian deserialization leading to JNDI remote class loading (9.8)
0day Rubbish disclosed an unauthenticated Hessian deserialization flaw in Accurate Online Private Cloud on-prem allowing JNDI remote class loading, rated 9.8.
The 0day Rubbish Research Team publicly disclosed an unauthenticated Hessian deserialization vulnerability in the current on-premises release of Accurate Online Private Cloud. The flaw lets unauthenticated attackers trigger JNDI remote class loading, a path that typically yields remote code execution. The issue carries a CVSS 9.8 rating. No CVE identifier or evidence of in-the-wild exploitation was included in the disclosure.