Executive Summary
A critical insecure deserialization vulnerability (CVE-2026-93467) has been disclosed in OAKlouds, a platform developed by Taiwan-based vendor HGiga. The flaw allows a fully unauthenticated remote attacker to execute arbitrary code on the server by sending maliciously crafted serialized content.
CVSS Score: 9.8 (Critical) — 9.3 under CVSS 4.0
Unlike many high-severity CVEs disclosed this week, this one requires no credentials and no user interaction at all, placing it at the top of the severity scale.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-93467 |
| CWE | CWE-502 (Deserialization of Untrusted Data) |
| CVSS Score | 9.8 (Critical) |
| Type | Unauthenticated Insecure Deserialization → RCE |
| Attack Vector | Network |
| Privileges Required | None |
| User Interaction | None |
| Assigner | TWCERT (Taiwan CERT) |
| Published | September 18, 2026 |
Root Cause
OAKlouds accepts user-supplied serialized content and reconstructs it into native object structures without verifying the integrity or origin of the payload first. An attacker can craft a malicious serialized stream that abuses unsafe reflection mechanisms in the underlying runtime, causing the server to execute attacker-controlled code during the deserialization process itself — before any application-level authentication check ever runs.
Affected Component
| Product | Affected Versions | Fixed Version |
|---|---|---|
| HGiga OAKlouds-custom_page | 2.0 | Not yet published |
As of disclosure, HGiga has not published a fixed version number, and public tracking sources note no confirmed-safe version. Administrators should not assume any deployed version is unaffected without direct confirmation from HGiga.
A related flaw, CVE-2026-93468, was disclosed alongside this one — an unauthenticated arbitrary file read via relative path traversal (CVSS 7.5) in the OAKlouds-bulletin_v3 component. Organizations running OAKlouds should treat both as part of the same patching effort.
Attack Vector
1. Attacker identifies an internet-facing OAKlouds-custom_page 2.0 deployment
2. Attacker crafts a malicious serialized object exploiting an unsafe gadget chain
3. Attacker submits the payload to the deserialization endpoint — no login required
4. The application reconstructs the object without validating its origin
5. Attacker-controlled code executes on the server
6. Full server compromise — no prior access neededImpact of Successful Exploitation
| Impact | Description |
|---|---|
| Remote Code Execution | Arbitrary code execution with no authentication |
| Full Server Compromise | Potential access to all data and connected systems |
| Chained Exploitation | Can be combined with CVE-2026-93468 for file-level reconnaissance |
| Data Exfiltration | Access to any data processed by the affected server |
Remediation
Immediate Mitigations (No Patch Available Yet)
- Restrict network access to OAKlouds management interfaces — do not expose them directly to the internet
- Deploy a WAF configured to detect anomalous serialized payloads and unusual request body sizes consistent with gadget-chain exploitation
- Monitor for TWCERT and HGiga advisories for an official patched version
- Restrict server-side access to only the ports and protocols OAKlouds actually requires
Once a Patch Is Available
- Apply the HGiga-published fix as soon as it is released
- Enforce strict type checking during deserialization — whitelist allowed classes rather than relying on dynamic resolution
- Review server logs for the affected date range for signs of exploitation attempts
Detection Indicators
| Indicator | Description |
|---|---|
| Unusually large or malformed serialized request bodies | Possible gadget-chain exploitation attempt |
| Unexpected outbound connections from the OAKlouds host | Post-exploitation data exfiltration or C2 |
| New or modified files on the server outside normal deployment activity | Sign of successful code execution |
| Requests to deserialization endpoints from unfamiliar IPs | Reconnaissance or exploitation attempts |