A critical deserialization vulnerability in ibaPDA and ibaDatCoordinator, tracked as CVE-2026-8024, allows remote attackers to execute arbitrary code without authentication, rated 9.3 on the CVSS scale. Affected versions include ibaPDA prior to 8.14.0 and ibaDatCoordinator before 4.0.7. The flaw arises from improper handling of .NET BinaryFormatter during deserialization, enabling privilege escalation. Users are advised to update to the patched versions immediately or restrict connections and tighten firewall rules as interim measures.
Critical iba Deserialization Vulnerability Exposes ibaPDA and ibaDatCoordinator to RCE (CVE-2026-8024)
CyberSIXT Evidence Panel
Article by CyberSIXT