Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
Alfresco Activiti: Malicious Data Can Be Injected Through Process Variables
CVE-2026-3967
Summary
A security issue has been discovered in Alfresco Activiti versions 7.19 and 8.8.0. This issue allows an attacker to inject malicious data through the system's process variables. If not addressed, an attacker could potentially exploit this vulnerability remotely. We recommend updating to a fixed version as soon as possible.
Original title
A flaw has been found in Alfresco Activiti up to 7.19/8.8.0. Affected by this issue is the function deserialize/createObjectInputStream of the file activiti-core/activiti-engine/src/main/java/org/a...
Original description
A flaw has been found in Alfresco Activiti up to 7.19/8.8.0. Affected by this issue is the function deserialize/createObjectInputStream of the file activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/variable/SerializableType.java of the component Process Variable Serialization System. This manipulation causes deserialization. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
nvd CVSS2.0
6.5
nvd CVSS3.1
6.3
nvd CVSS4.0
5.3
Vulnerability type
CWE-20
Improper Input Validation
CWE-502
Deserialization of Untrusted Data
Published: 12 Mar 2026 · Updated: 13 Mar 2026 · First seen: 12 Mar 2026