CVE-2026-75987 Overview
CVE-2026-75987 is an insecure deserialization vulnerability in SPLWare esProc versions up to build 20260507. The flaw resides in the ObjectInputStream.readUnshared call within src/main/java/com/scudata/parallel/SocketData.java. An attacker can send a crafted serialized Java object over the network to trigger unsafe deserialization. The issue is classified under CWE-20 (Improper Input Validation) and is remotely reachable without authentication or user interaction.
Critical Impact
Remote attackers can submit malicious serialized objects to the affected socket handler, resulting in untrusted deserialization that may compromise confidentiality, integrity, and availability of the esProc server.
Affected Products
- SPLWare esProc up to build 20260507
- Component: com.scudata.parallel.SocketData
- Function: ObjectInputStream.readUnshared
Discovery Timeline
- 2026-08-19 - CVE-2026-75987 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-75987
Vulnerability Analysis
The vulnerability exists in the parallel processing subsystem of SPLWare esProc. The SocketData class reads incoming network data using ObjectInputStream.readUnshared, a Java API that reconstructs arbitrary object graphs from a byte stream. When the input stream is attacker-controlled and no allow-list or filter is applied, deserialization can instantiate gadget chains present on the classpath. This allows an attacker to influence application state or trigger dangerous side effects during object reconstruction. The remote attack vector and lack of authentication make the endpoint reachable directly from the network. The published EPSS data indicates a low near-term exploitation probability, but the presence of a documented root cause increases the value of proactive remediation.
Root Cause
The root cause is improper input validation on serialized Java objects received over the socket channel. readUnshared alone does not restrict which classes may be deserialized. Without an ObjectInputFilter or equivalent allow-list, any class reachable on the classpath can be materialized from attacker-supplied bytes, satisfying the conditions for gadget-based deserialization attacks.
Attack Vector
An attacker connects to the exposed esProc parallel service port and sends a serialized payload crafted to trigger a deserialization gadget chain. Because the vulnerability requires no privileges and no user interaction, exploitation can be automated against internet-exposed instances. Successful exploitation may lead to data disclosure, data tampering, or service disruption within the esProc process.
No verified public proof-of-concept code has been released. See the GitHub Issue #67 and VulDB entry for CVE-2026-75987 for additional technical context.
Detection Methods for CVE-2026-75987
Indicators of Compromise
- Unexpected inbound TCP connections to the esProc parallel service port from untrusted networks.
- Java stack traces referencing com.scudata.parallel.SocketData and ObjectInputStream.readUnshared in application logs.
- Spawning of unexpected child processes or outbound connections from the esProc JVM process shortly after socket activity.
Detection Strategies
- Inspect network traffic to esProc listeners for the Java serialization magic bytes AC ED 00 05 from unauthenticated peers.
- Correlate JVM audit logs with process telemetry to identify deserialization events followed by anomalous command execution.
- Deploy runtime application self-protection or Java agents that log invocations of readUnshared and flag high-risk class instantiations.
Monitoring Recommendations
- Enable verbose logging on com.scudata.parallel classes and forward logs to a central SIEM for retention and correlation.
- Baseline normal peers of the esProc parallel port and alert on new source IPs, especially from external ranges.
- Monitor for gadget-class loads such as commons-collections InvokerTransformer or similar chains within the esProc JVM.
How to Mitigate CVE-2026-75987
Immediate Actions Required
- Restrict network access to the esProc parallel service port to trusted management networks only, using firewall rules or security groups.
- Audit exposed esProc deployments to identify any instances reachable from the internet and take them offline pending remediation.
- Enable mutual TLS or IPsec on the parallel channel where supported to prevent unauthenticated peers from sending serialized data.
Patch Information
At the time of publication, no vendor-issued fixed version is referenced in the NVD entry. Track the upstream repository at SPLWare/esProc and the tracking discussion in GitHub Issue #67 for a patched release. Upgrade to a build newer than 20260507 once the maintainers publish a fix that filters deserialized classes.
Workarounds
- Apply a JVM-wide ObjectInputFilter via the jdk.serialFilter system property to allow-list only required classes.
- Remove unused libraries known to contain deserialization gadgets from the esProc classpath where feasible.
- Place the esProc parallel port behind a reverse proxy or VPN that enforces authentication before traffic reaches the JVM.
# Example: restrict Java deserialization globally with an allow-list filter
# Replace com.scudata.** with the minimum set of classes required by your deployment
java -Djdk.serialFilter='com.scudata.**;java.base/*;!*' \
-jar esProc-server.jar
# Example: iptables rule to restrict access to the esProc parallel port (default 8281)
iptables -A INPUT -p tcp --dport 8281 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8281 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
