Deserialization Vulnerability in SPLWare esProc

SPLWare esProc versions up to and including 20260507 are vulnerable to a remote deserialization flaw identified as CVE-2026-75987. The vulnerability exists in the ObjectInputStream.readUnshared function located within src/main/java/com/scudata/parallel/SocketData.java.

The flaw allows an unauthenticated remote attacker to pass untrusted serialized objects to the application, which are then improperly processed by the readUnshared method. Because the application fails to validate the input before deserialization, an attacker can manipulate the object stream to achieve remote code execution (RCE) on the underlying server. Given the nature of Java deserialization vulnerabilities, successful exploitation typically results in complete system compromise. Organizations running SPLWare esProc should audit their instances for this version and evaluate the necessity of exposure to the network.

Impact

Successful exploitation of CVE-2026-75987 allows an unauthenticated remote attacker to achieve arbitrary code execution. This impacts the confidentiality, integrity, and availability of the host server. The vulnerability is present in the SocketData.java component, suggesting that any exposed network socket used for parallel processing or data transmission is a potential vector for attack.

Recommendation

• Upgrade SPLWare esProc to a version later than 20260507 to remediate the vulnerability in SocketData.java.
• Isolate instances of esProc that are currently exposed to the internet until the patch is applied.
• Review network access control lists (ACLs) to restrict access to ports utilized by esProc parallel processing services to trusted internal sources only.
• Monitor application logs for unexpected deserialization errors or serialized object payloads that do not correspond to expected internal communication patterns.