{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T20:45:43.249Z",
  "tag": {
    "id": "deserialization",
    "label": "Deserialization",
    "isStack": false,
    "url": "https://pwn.watch/t/deserialization",
    "feed": "https://pwn.watch/t/deserialization/feed.xml"
  },
  "counts": {
    "incidents": 7,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 7
  },
  "incidents": [
    {
      "slug": "apache-activemq-openwire-rce-cve-2023-46604",
      "title": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)",
      "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604",
      "json": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Apache ActiveMQ (Java OpenWire brokers and clients)",
      "tags": [
        "java",
        "apache",
        "activemq",
        "rce",
        "deserialization",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-46604"
      ],
      "affectedVersions": [
        "See vendor advisory"
      ],
      "fixedVersions": [
        "5.15.16",
        "5.16.7",
        "5.17.6",
        "5.18.3"
      ],
      "startedAt": "2023-10-27",
      "closedAt": "2023-11-02",
      "updatedAt": "2023-11-02",
      "summary": "A deserialization flaw in ActiveMQ's Java OpenWire protocol marshaller let anyone who could reach a broker run shell commands on it. Within days of the fix, attackers were deploying HelloKitty ransomware through it.",
      "xPost": null
    },
    {
      "slug": "progress-ws-ftp-server-cve-2023-40044",
      "title": "Progress WS_FTP Server: Deserialization of Untrusted Data (CVE-2023-40044)",
      "url": "https://pwn.watch/i/progress-ws-ftp-server-cve-2023-40044",
      "json": "https://pwn.watch/i/progress-ws-ftp-server-cve-2023-40044.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Progress WS_FTP Server",
      "tags": [
        "progress",
        "ransomware",
        "cisa-kev",
        "deserialization"
      ],
      "cveIds": [
        "CVE-2023-40044"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-10-05",
      "closedAt": "2023-10-05",
      "updatedAt": "2023-10-05",
      "summary": "Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system. Added to CISA KEV on 2023-10-05. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "adobe-coldfusion-cve-2023-26359",
      "title": "Adobe ColdFusion: Deserialization of Untrusted Data (CVE-2023-26359)",
      "url": "https://pwn.watch/i/adobe-coldfusion-cve-2023-26359",
      "json": "https://pwn.watch/i/adobe-coldfusion-cve-2023-26359.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Adobe ColdFusion",
      "tags": [
        "adobe",
        "coldfusion",
        "cisa-kev",
        "deserialization"
      ],
      "cveIds": [
        "CVE-2023-26359"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-08-21",
      "closedAt": "2023-08-21",
      "updatedAt": "2023-08-21",
      "summary": "Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user. Added to CISA KEV on 2023-08-21.",
      "xPost": null
    },
    {
      "slug": "netwrix-auditor-cve-2022-31199",
      "title": "Netwrix Auditor: Insecure Object Deserialization (CVE-2022-31199)",
      "url": "https://pwn.watch/i/netwrix-auditor-cve-2022-31199",
      "json": "https://pwn.watch/i/netwrix-auditor-cve-2022-31199.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Netwrix Auditor",
      "tags": [
        "netwrix",
        "ransomware",
        "cisa-kev",
        "deserialization"
      ],
      "cveIds": [
        "CVE-2022-31199"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-07-11",
      "closedAt": "2023-07-11",
      "updatedAt": "2023-07-11",
      "summary": "Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling. Added to CISA KEV on 2023-07-11. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "novi-survey-cve-2023-29492",
      "title": "Novi Survey: Insecure Deserialization (CVE-2023-29492)",
      "url": "https://pwn.watch/i/novi-survey-cve-2023-29492",
      "json": "https://pwn.watch/i/novi-survey-cve-2023-29492.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Novi Survey",
      "tags": [
        "novi-survey",
        "cisa-kev",
        "deserialization"
      ],
      "cveIds": [
        "CVE-2023-29492"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-04-13",
      "closedAt": "2023-04-13",
      "updatedAt": "2023-04-13",
      "summary": "Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account. Added to CISA KEV on 2023-04-13.",
      "xPost": null
    },
    {
      "slug": "adobe-coldfusion-cve-2023-26360",
      "title": "Adobe ColdFusion: Deserialization of Untrusted Data (CVE-2023-26360)",
      "url": "https://pwn.watch/i/adobe-coldfusion-cve-2023-26360",
      "json": "https://pwn.watch/i/adobe-coldfusion-cve-2023-26360.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Adobe ColdFusion",
      "tags": [
        "adobe",
        "coldfusion",
        "cisa-kev",
        "rce",
        "deserialization"
      ],
      "cveIds": [
        "CVE-2023-26360"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-03-15",
      "closedAt": "2023-03-15",
      "updatedAt": "2023-03-15",
      "summary": "Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution. Added to CISA KEV on 2023-03-15.",
      "xPost": null
    },
    {
      "slug": "ibm-aspera-faspex-cve-2022-47986",
      "title": "IBM Aspera Faspex: Code Execution (CVE-2022-47986)",
      "url": "https://pwn.watch/i/ibm-aspera-faspex-cve-2022-47986",
      "json": "https://pwn.watch/i/ibm-aspera-faspex-cve-2022-47986.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "IBM Aspera Faspex",
      "tags": [
        "ibm",
        "ransomware",
        "cisa-kev",
        "deserialization"
      ],
      "cveIds": [
        "CVE-2022-47986"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-02-21",
      "closedAt": "2023-02-21",
      "updatedAt": "2023-02-21",
      "summary": "IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw. Added to CISA KEV on 2023-02-21. CISA lists known use in ransomware campaigns.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "apache-activemq-openwire-rce-cve-2023-46604",
      "incidentTitle": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-11-02",
      "title": "CISA adds CVE-2023-46604 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604"
    },
    {
      "incident": "apache-activemq-openwire-rce-cve-2023-46604",
      "incidentTitle": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-11-01",
      "title": "Rapid7 reports exploitation in two customer environments, attempting to deploy HelloKitty ransomware",
      "body": null,
      "sourceUrl": "https://www.rapid7.com/blog/post/2023/11/01/etr-suspected-exploitation-of-apache-activemq-cve-2023-46604/",
      "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604"
    },
    {
      "incident": "apache-activemq-openwire-rce-cve-2023-46604",
      "incidentTitle": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-27",
      "title": "Apache publishes the CVE-2023-46604 announcement; fixed releases already out",
      "body": null,
      "sourceUrl": "https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt",
      "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604"
    },
    {
      "incident": "progress-ws-ftp-server-cve-2023-40044",
      "incidentTitle": "Progress WS_FTP Server: Deserialization of Untrusted Data (CVE-2023-40044)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-05",
      "title": "CISA added CVE-2023-40044 to the KEV catalog (due 2023-10-26).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/progress-ws-ftp-server-cve-2023-40044"
    },
    {
      "incident": "adobe-coldfusion-cve-2023-26359",
      "incidentTitle": "Adobe ColdFusion: Deserialization of Untrusted Data (CVE-2023-26359)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-08-21",
      "title": "CISA added CVE-2023-26359 to the KEV catalog (due 2023-09-11).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/adobe-coldfusion-cve-2023-26359"
    },
    {
      "incident": "netwrix-auditor-cve-2022-31199",
      "incidentTitle": "Netwrix Auditor: Insecure Object Deserialization (CVE-2022-31199)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-11",
      "title": "CISA added CVE-2022-31199 to the KEV catalog (due 2023-08-01).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/netwrix-auditor-cve-2022-31199"
    },
    {
      "incident": "novi-survey-cve-2023-29492",
      "incidentTitle": "Novi Survey: Insecure Deserialization (CVE-2023-29492)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-04-13",
      "title": "CISA added CVE-2023-29492 to the KEV catalog (due 2023-05-04).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/novi-survey-cve-2023-29492"
    },
    {
      "incident": "adobe-coldfusion-cve-2023-26360",
      "incidentTitle": "Adobe ColdFusion: Deserialization of Untrusted Data (CVE-2023-26360)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-03-15",
      "title": "CISA added CVE-2023-26360 to the KEV catalog (due 2023-04-05).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/adobe-coldfusion-cve-2023-26360"
    },
    {
      "incident": "ibm-aspera-faspex-cve-2022-47986",
      "incidentTitle": "IBM Aspera Faspex: Code Execution (CVE-2022-47986)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-02-21",
      "title": "CISA added CVE-2022-47986 to the KEV catalog (due 2023-03-14).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/ibm-aspera-faspex-cve-2022-47986"
    }
  ]
}