CVE-2026-3245: PRISMAproduction RCE Vulnerability

CVE-2026-3245 Overview

CVE-2026-3245 is a deserialization vulnerability [CWE-502] affecting Canon PRISMAproduction version 6.5 and earlier. The flaw allows an attacker on an adjacent network to trigger unsafe deserialization of untrusted data, potentially leading to arbitrary code execution on the affected server. PRISMAproduction is Canon's production print workflow management software deployed in commercial print environments. Exploitation requires no authentication or user interaction, though the attack complexity is rated as high. Successful exploitation compromises the confidentiality, integrity, and availability of the affected system.

Critical Impact
Unsafe deserialization in PRISMAproduction 6.5 and earlier can allow adjacent-network attackers to execute arbitrary code on the print workflow server without authentication.

Affected Products

Canon PRISMAproduction version 6.5
Canon PRISMAproduction versions earlier than 6.5
Canon production print workflow deployments running vulnerable PRISMAproduction builds

Discovery Timeline

2026-08-03 - CVE-2026-3245 published to the National Vulnerability Database
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-3245

Vulnerability Analysis

The vulnerability stems from insecure deserialization of untrusted data within Canon PRISMAproduction. When the application deserializes attacker-controlled input without validating object types or integrity, an adversary can craft a serialized payload that invokes unintended methods during reconstruction. This class of flaw, tracked as [CWE-502], commonly enables arbitrary code execution when gadget chains are available in the application's classpath.

Because the attack vector is adjacent, an attacker must be positioned on the same logical network segment as the PRISMAproduction server. No credentials or user interaction are required. The impact spans confidentiality, integrity, and availability, meaning a successful attacker can read data, modify print jobs and configuration, and disrupt production workflows.

Root Cause

The root cause is the application's acceptance and deserialization of untrusted serialized objects without type filtering, allow-listing, or integrity verification. During object reconstruction, magic methods and constructors execute automatically, giving an attacker a path to code execution when a suitable gadget chain exists in the runtime.

Attack Vector

An attacker with adjacent-network access sends a crafted serialized payload to a network service exposed by PRISMAproduction. The server deserializes the object, triggering the gadget chain and executing attacker-controlled code in the context of the PRISMAproduction service account. Refer to the Canon CVE-2026-3245 Vulnerability advisory and Canon Advisory CP2026-007 for vendor technical details.

// No verified proof-of-concept code is available for CVE-2026-3245.
// Refer to Canon's advisory for technical guidance.

Detection Methods for CVE-2026-3245

Indicators of Compromise

Unexpected child processes spawned by the PRISMAproduction service account, particularly shells, scripting hosts, or cmd.exe
Outbound network connections from the PRISMAproduction host to unfamiliar external addresses shortly after inbound traffic on service ports
New or modified files in PRISMAproduction working directories that do not correspond to legitimate print job activity
Service crashes, restarts, or deserialization exceptions in PRISMAproduction application logs

Detection Strategies

Inspect application and Windows event logs for deserialization exceptions, class-not-found errors, or stack traces referencing serialization libraries
Baseline normal process ancestry for PRISMAproduction services and alert on deviations such as script interpreters or living-off-the-land binaries
Monitor east-west network traffic to PRISMAproduction listeners from hosts that do not normally submit print workflow jobs

Monitoring Recommendations

Forward PRISMAproduction application logs and host telemetry to a centralized SIEM or data lake for correlation with network flow data
Enable command-line and process-creation auditing on the PRISMAproduction server to capture post-exploitation behavior
Alert on any authentication or configuration change events originating from the PRISMAproduction service account

How to Mitigate CVE-2026-3245

Immediate Actions Required

Identify all PRISMAproduction 6.5 and earlier deployments and inventory their network exposure
Restrict network access to PRISMAproduction servers so that only authorized print operator workstations can reach service ports
Apply the vendor-provided update or mitigation described in Canon Advisory CP2026-007 as soon as it is available for your region
Review PRISMAproduction hosts for signs of prior exploitation using the indicators listed above

Patch Information

Canon has published guidance for this vulnerability. Consult the Canon CPA2026-007 Vulnerability Notice and the Canon Product Security Support portal for the fixed version and installation instructions applicable to your PRISMAproduction deployment.

Workarounds

Segment PRISMAproduction servers onto a dedicated VLAN and enforce host-based firewall rules that only permit traffic from known print operator hosts
Disable or block network-exposed services on the PRISMAproduction host that are not required for daily operations
Require VPN or jump-host access for any administrative or workflow interaction with PRISMAproduction until the patch is applied

bash

# Example: restrict inbound access to PRISMAproduction host using Windows Firewall
# Replace <PORT> with the PRISMAproduction service port and <ALLOWED_SUBNET> with your print operator subnet
netsh advfirewall firewall add rule name="PRISMAproduction-Restrict" ^
  dir=in action=allow protocol=TCP localport=<PORT> ^
  remoteip=<ALLOWED_SUBNET>
netsh advfirewall firewall add rule name="PRISMAproduction-Block-Others" ^
  dir=in action=block protocol=TCP localport=<PORT>