Insecure Deserialization Vulnerability in EasyFlow .NET by Digiwin
CVE-2026-102455

9.3CRITICAL

Key Information:

Vendor

Digiwin

Status
Easyflow .net
Vendor
CVE Published:
30 September 2026

What is CVE-2026-102455?

The EasyFlow .NET application developed by Digiwin is vulnerable due to insecure deserialization. This flaw allows unauthenticated remote attackers to exploit the system by sending specially crafted serialized data. If successfully executed, the attackers can run arbitrary code on the server, potentially compromising the integrity and security of the entire system. Implementing proper validation and sanitization of input data is crucial to mitigate the risk posed by this vulnerability.

Affected Version(s)

EasyFlow .NET 6.1.*

EasyFlow .NET 6.6 <= 6.6.19

EasyFlow .NET 8.1 <= 8.1.5

References

https://www.twcert.org.tw/tw/cp-132-11237-c9189-1.html
third-party-advisory
https://www.twcert.org.tw/en/cp-139-11242-13f37-2.html
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.