Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Next4Biz CSM may let attackers run code

CVE-2026-7861 · published 1 month ago
Summary

Versions of Next4Biz Customer Service Management before 8.0.3 can be tricked into running harmful code when they handle data from outside sources. This could let a bad actor take control of the system or steal information. Upgrade to version 8.0.3 or later and only accept data from trusted origins.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
next4biz information technologies inc. csm (customer service management) < 8.0.3
<= 07092026
Original advisory text
Code Injection in Next4Biz's CSM (Customer Service Management)
Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Code Injection.

This issue affects CSM (Customer Service Management): before 8.0.3.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published7 Sep 2026
Updated11 Oct 2026
First seen8 Sep 2026
Sources
CVE-2026-7861 · NVD
CVE-2026-7861 · MITRE
Track software like this
Free during beta