{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3auniongwebitr/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:uniong:webitr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-113404"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WebITR"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","rce","deserialization"],"_cs_type":"advisory","_cs_vendors":["Uniong"],"content_html":"\u003cp\u003eWebITR, developed by Uniong, is affected by an insecure deserialization vulnerability identified as CVE-2026-113404. This vulnerability arises because the application utilizes a hard-coded cryptographic key to handle serialized objects. An authenticated remote attacker can exploit this weakness by crafting custom serialized payloads signed with the hard-coded key. When submitted to the application, the server deserializes these objects, resulting in arbitrary code execution on the underlying host. This flaw is critical for defenders because it permits full system compromise from a standard authenticated user session, bypassing standard application-level access controls.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for remote code execution on the server hosting the WebITR application. This impact is significant as it grants the attacker the privileges of the service account running the application, which could lead to full system takeover, lateral movement, or data exfiltration. The threat is categorized with a CVSS v3.1 base score of 8.8.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor application logs for anomalous serialized data inputs or unexpected process execution spawned by the WebITR service account.\u003c/li\u003e\n\u003cli\u003eImplement strict ingress filtering for the WebITR application to limit authentication to trusted IP ranges.\u003c/li\u003e\n\u003cli\u003eApply security patches provided by Uniong as soon as they become available for CVE-2026-113404.\u003c/li\u003e\n\u003cli\u003eEnsure the service account running the WebITR application follows the principle of least privilege to minimize the impact of successful code execution.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T08:33:53Z","date_published":"2026-10-20T08:33:53Z","id":"https://feed.craftedsignal.io/briefs/2026-10-webitr-deserialization/","summary":"Uniong WebITR contains an insecure deserialization vulnerability, CVE-2026-113404, allowing authenticated remote attackers to execute arbitrary code via malicious serialized data.","title":"Insecure Deserialization in Uniong WebITR","url":"https://feed.craftedsignal.io/briefs/2026-10-webitr-deserialization/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:uniong:webitr:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}