Log in Start free

Vulnerability · Published Aug 14, 2026 · Assigned by VulDB

CVE-2026-19826alldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.readObject deserialization

High 7.3

In plain English

A high-severity unsafe deserialization in alldata from alldatacenter. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.6%top 52.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The project closed the issue report as "not planned" without any further explanation.

Affected products (as reported)

VendorProductVersions
alldatacenter alldata 0.6.00.6.10.6.20.6.30.6.40.6.50.6.60.6.7

Weakness: CWE-502, CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References