CVE-2026-75987

Deferred Deferred - Pending Action

Deserialization Vulnerability in SPLWare esProc

Publication date: 2026-08-19

Last updated on: 2026-08-21

Assigner: VulDB

Description

A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/parallel/SocketData.java. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-21

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-75987

EUVD

EUVD-2026-62221

Affected Vendors & Products

Vendor	Product	Version / Range
splware	esproc	to 20260507 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

CVE-2026-75987 is a Java deserialization remote code execution (RCE) vulnerability in SPLWare esProc up to version 20260507. The flaw exists in the ObjectInputStream.readUnshared function of SocketData.java, where the server deserializes objects directly from raw TCP sockets without any class restrictions or filters. An attacker can exploit this by sending a crafted serialized Java object to the server on TCP port 8281, triggering deserialization before authentication or request parsing occurs. This leads to RCE if a suitable gadget chain is present on the classpath.

Detection Guidance

Check if the esProc server is listening on TCP port 8281 using netstat or ss commands. Scan for open ports with nmap -p 8281 <target>. Monitor network traffic for unexpected Java deserialization attempts or connections to port 8281.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary code on the affected esProc server without authentication. An attacker could gain full control over the server, steal sensitive data, install malware, or disrupt services. The default TCP port 8281 exposure increases the risk, especially if the server is accessible over a network. Exploitation bypasses IP whitelisting and other security measures due to immediate deserialization upon connection.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security and privacy rules. Organizations using esProc may face compliance violations, legal penalties, and reputational damage if exploited. The lack of proper deserialization controls undermines security best practices required by these regulations.

Mitigation Strategies

Disable the esProc server if not needed. If required, restrict access to port 8281 via firewall rules. Apply Java security updates and configure ObjectInputFilter to block unsafe deserialization. Ensure network segmentation to limit exposure.

Hi! I’m here to help you understand CVE-2026-75987. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70