A critical insecure deserialization flaw in HGiga's OAKlouds platform lets unauthenticated remote attackers execute arbitrary code on the server by sending maliciously crafted serialized content.
What Is It
CVE-2026-93467 is a CWE-502 (Deserialization of Untrusted Data) vulnerability in OAKlouds, developed by HGiga. According to the advisory, unauthenticated remote attackers can execute arbitrary code on the server by submitting maliciously crafted serialized content. The issue was published on 2026-09-18 and reported by TWCERT/CC.
It carries a CVSS v3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A CVSS v4.0 score of 9.3 (CRITICAL) was also assigned.
Why It Matters
Every factor that makes a vulnerability easy to weaponize is present: network attack vector, low attack complexity, no privileges required, and no user interaction. Confidentiality, integrity, and availability impacts are all rated HIGH, which indicates the maximum severity rating in each impact dimension; in practice, code execution on the server would give an attacker substantial control over the application and its data, though the precise blast radius depends on how the service is deployed and what privileges it runs with.
The CISA Known Exploited Vulnerabilities catalog has no entry for this CVE as of 2026-09-18, so there is no confirmation of active exploitation at this time. The NVD record remains in "Received" status, meaning NVD analysis is not yet complete and details may change.
What's Vulnerable
Per the vendor-supplied affected data, three OAKlouds custom_page product lines are affected, all in versions below 26:
| Product | Affected versions |
|---|---|
| OAKlouds-custom_page-2.0 | 0 to < 26 |
| OAKlouds-custom_page-3.0 | 0 to < 26 |
| OAKlouds-custom_page-4.0 | 0 to < 26 |
All other versions are listed with a default status of unaffected. No CPE entries have been published yet.
Patch Status
The affected-version ranges imply that version 26 and later resolve the issue for each of the 2.0, 3.0, and 4.0 product lines. The supplied data contains no explicit remediation instructions, patch release date, or workaround guidance beyond the TWCERT advisories linked below. Administrators should consult those advisories directly for vendor upgrade instructions.
Sources
- NVD, CVE-2026-93467: https://nvd.nist.gov/vuln/detail/CVE-2026-93467
- TWCERT/CC Advisory (English): https://www.twcert.org.tw/en/cp-139-11211-d2aa9-2.html
- TWCERT/CC Advisory (Chinese): https://www.twcert.org.tw/tw/cp-132-11210-11cb0-1.html
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog