CVE-2026-8735: Oinone Pamirs RCE Vulnerability

CVE-2026-8735 Overview

CVE-2026-8735 is an insecure deserialization vulnerability affecting Oinone Pamirs through version 7.2.0. The flaw resides in the JsonUtils.parseMap function within PamirsParserConfig.java, reachable through the appConfigQuery interface. An authenticated remote attacker can manipulate input passed to the parser, triggering unsafe deserialization of attacker-controlled data. The issue is classified under [CWE-20] Improper Input Validation. A public exploit reference exists, and the vendor did not respond to disclosure attempts. While the CVSS 4.0 base score is 2.1, deserialization weaknesses can escalate in impact depending on the gadget classes available on the runtime classpath.

Critical Impact
Remote, low-privileged attackers can submit crafted JSON to the appConfigQuery interface to trigger deserialization through JsonUtils.parseMap, with no vendor patch currently published.

Affected Products

Oinone Pamirs versions up to and including 7.2.0
PamirsParserConfig.java component
appConfigQuery interface consumers

Discovery Timeline

2026-05-17 - CVE-2026-8735 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-8735

Vulnerability Analysis

The vulnerability resides in the JsonUtils.parseMap function defined in PamirsParserConfig.java. The function is invoked through the appConfigQuery interface and processes externally supplied JSON content without sufficient validation of object types or class hierarchies. When attacker-controlled JSON reaches the parser, the deserialization routine instantiates objects based on data the caller controls. This pattern aligns with [CWE-20] Improper Input Validation and is the foundation of polymorphic JSON deserialization attacks in Java ecosystems.

The attack is network-reachable and requires low privileges. According to the disclosure, an exploit reference is publicly available through the GitHub Issue Report and tracked by VulDB Vulnerability #364323. No vendor patch or coordinated response has been documented.

Root Cause

The root cause is the use of a permissive JSON-to-object mapping routine that does not enforce a strict allow-list of expected types. JsonUtils.parseMap accepts arbitrary keys and values and binds them into Java objects, allowing class hints or nested structures supplied by the caller to influence object construction. Combined with the absence of input validation at the appConfigQuery boundary, this exposes the parser to untrusted payloads.

Attack Vector

Exploitation requires network access to the appConfigQuery endpoint and an authenticated session with low privileges. The attacker submits a crafted query whose body contains JSON parsed by JsonUtils.parseMap. The parser instantiates and populates objects from that payload, enabling downstream deserialization side effects. Practical impact depends on the gadget classes present on the application classpath, which dictate whether the issue is limited to logic abuse or extends to broader compromise.

No verified exploit code is reproduced here. Technical context is documented in the VulDB CTI for #364323.

Detection Methods for CVE-2026-8735

Indicators of Compromise

Inbound HTTP requests to the appConfigQuery interface containing JSON bodies with unexpected type hints, class identifiers, or nested object graphs.
Application logs showing exceptions originating from JsonUtils.parseMap or PamirsParserConfig.java during query processing.
Java process spawning unexpected child processes such as shells, scripting runtimes, or network utilities shortly after appConfigQuery traffic.

Detection Strategies

Inspect web application and reverse proxy logs for appConfigQuery requests with abnormally large or deeply nested JSON payloads.
Enable verbose logging on the Pamirs application tier to capture stack traces tied to deserialization errors.
Correlate authentication events with appConfigQuery activity to identify low-privileged accounts probing the interface.

Monitoring Recommendations

Forward Pamirs application and access logs to a centralized analytics platform for anomaly review.
Monitor outbound connections from the Pamirs host process to detect post-exploitation command-and-control activity.
Track file system and process creation events on application servers running Oinone Pamirs to identify deserialization-driven payload execution.

How to Mitigate CVE-2026-8735

Immediate Actions Required

Restrict network access to the appConfigQuery interface to trusted administrative networks until a vendor fix is available.
Audit accounts that hold privileges sufficient to reach appConfigQuery and disable unused credentials.
Deploy a web application firewall rule that blocks JSON payloads containing polymorphic type hints destined for the Pamirs endpoint.

Patch Information

No vendor patch has been published. According to the advisory, the vendor was contacted early and did not respond. Track the VulDB Vulnerability #364323 entry and the upstream project repository for future fixes. Until a patched release for Oinone Pamirs after 7.2.0 is available, treat affected deployments as unpatched and apply compensating controls.

Workarounds

Place the Pamirs appConfigQuery interface behind authenticated reverse proxies that enforce strict JSON schema validation.
Remove or restrict classpath gadget libraries that are not required by the application to reduce deserialization impact.
Apply rate limiting and request size limits on the appConfigQuery endpoint to constrain exploitation attempts.

bash

# Example reverse-proxy restriction (nginx) limiting appConfigQuery access
location /appConfigQuery {
    allow 10.0.0.0/8;        # internal admin network only
    deny  all;
    client_max_body_size 16k; # constrain JSON payload size
    proxy_pass http://pamirs_backend;
}