Vulnerability · Published Jun 26, 2026 · Assigned by VulnCheck

CVE-2026-57527ZAP ViewState Add-on Insecure Deserialization via JSFViewState.decode()

High 8.8

In plain English

A high-severity unsafe deserialization in zap-extensions from zaproxy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.7%top 47.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter. The JSFViewState.decode() method base64-decodes the ViewState value and passes it directly to ObjectInputStream.readObject() without a deserialization filter, allowlist, or type restriction, causing the malicious object to be deserialized within the ZAP JVM when the Desktop UI renders the ViewState panel.

Affected products (as reported)

Vendor	Product	Versions
zaproxy	zap-extensions	0 – before 4

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://www.zaproxy.org/blog/2026-06-24-java-deserialization-vulnerability-in-zap-viewstate-addon/ technical-description, vendor-advisory
https://github.com/zaproxy/zap-extensions/releases/tag/viewstate-v4 release-notes
https://github.com/zaproxy/zap-extensions/pull/7481 issue-tracking
https://github.com/zaproxy/zap-extensions/commit/ac6c3f94d38505bc0facea286a4d3728044c6e5c patch
https://www.vulncheck.com/advisories/zap-viewstate-add-on-insecure-deserialization-via-jsfviewstate-decode third-party-advisory