9.1 CriticalCWE-502
CVE-2026-50076
Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass
Apache Software FoundationApache Fory
Status
- Not in CISA KEV
- Fixed in version 1.1.0
Exploit probabilityEPSSchecked 25 Oct
0.5%probability of exploitation in the next 30 days
Higher than 44% of scored CVEs
SeverityCVSS
9.1Critical
Description NVD
Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks and invoke classpath-present readResolve/readExternal hooks via crafted Fory serialized data. Users are recommended to upgrade to version 1.1.0 or later, which fixes this issue.
Coverage 1 article · 1 outlet
- Apache Fory flaw lets attackers run code remotely, CVE-2026-50076SecurityOnline · first in our coverage