Open-Web-Analytics - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/open-web-analytics/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 25 Sep 2026 14:53:29 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRemote Code Execution via Deserialization in Open-Web-Analyticshttps://feed.craftedsignal.io/briefs/2026-09-open-web-analytics-deserialization/Fri, 25 Sep 2026 14:53:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-open-web-analytics-deserialization/Open-Web-Analytics up to version 1.8.1 contains a remote deserialization vulnerability in the Remote Event Queue Endpoint that allows unauthenticated attackers to execute arbitrary code.A deserialization vulnerability exists in the Open-Web-Analytics (OWA) platform, specifically affecting versions 1.8.1 and earlier. The flaw resides within the Event::loadFromArray function located in the queue.php file, which is part of the Remote Event Queue Endpoint component. An unauthenticated remote attacker can exploit this vulnerability by sending a maliciously crafted payload to the endpoint, leading to insecure deserialization. Successful exploitation allows for arbitrary code execution on the underlying web server. Defenders should immediately upgrade to OWA version 1.8.2 or apply the official patch (78c1222ec0e2119d84684032da1541120a2cdd23) to mitigate this high-severity risk.

Impact

Successful exploitation of this vulnerability results in full remote code execution on the web server hosting Open-Web-Analytics. This could lead to a complete system compromise, unauthorized access to sensitive analytics data, or the use of the server as a pivot point for lateral movement within the network.

Recommendation

  • Upgrade Open-Web-Analytics to version 1.8.2 immediately to remediate CVE-2026-97865.
  • If an immediate upgrade is not possible, apply the specific patch 78c1222ec0e2119d84684032da1541120a2cdd23.
  • Monitor web server access logs for anomalous POST requests directed at the queue.php endpoint that contain serialized object structures or unusual query parameters.
]]>highadvisoryweb-applicationdeserializationrce