Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck

CVE-2023-54398Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet

Critical 9.8

In plain English

A critical-severity unsafe deserialization in U8 Cloud from Yonyou. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.2%top 31.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.

Affected products (as reported)

Vendor	Product	Versions
Yonyou	U8 Cloud	1.02.02.12.32.52.62.652.7

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Vendor Advisory vendor-advisory, patch
CN-SEC Blog technical-description, exploit
CSDN Blog technical-description, exploit
AVD Advisory third-party-advisory
Vendor Homepage product
https://www.vulncheck.com/advisories/yonyou-u8-cloud-java-deserialization-rce-via-filemanageservlet third-party-advisory