CVE-2026-78032
Deferred Deferred - Pending Action

Deserialization Flaw in SOY CMS Leads to Code Execution

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: JPCERT/CC

Description
SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-78032
EUVD
EUVD-2026-67579

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
tsuyoshi_saito soy_calendar 2.5.0
tsuyoshi_saito soy_cms 3.25.0
tsuyoshi_saito soy_gallery 2.1.0
tsuyoshi_saito soy_inquiry 2.11.0
tsuyoshi_saito soy_shop 2.15.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SOY CMS has a deserialization vulnerability where untrusted data can be processed, potentially allowing an attacker with web server privileges to execute arbitrary code.

Detection Guidance

Detecting this vulnerability requires checking for deserialization of untrusted data in SOY CMS. Inspect web server logs for unusual activity or requests containing serialized objects. Look for files or processes related to SOY CMS that may be handling untrusted input. No specific commands are provided in the context.

Impact Analysis

An attacker could gain control of the web server, execute malicious code, steal data, or disrupt services. This could lead to unauthorized access, data breaches, or system compromise.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties and reputational damage.

Mitigation Strategies

Immediately update SOY CMS to the latest patched version. Disable or restrict access to deserialization features if not required. Implement input validation for all user-supplied data. Monitor for suspicious activity or unauthorized code execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78032. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart