Remote Code Execution Vulnerability in DHIS2 Information System
CVE-2026-55083

9.1CRITICAL

Key Information:

Vendor

Dhis2

Status
Dhis2-core
Vendor
CVE Published:
1 October 2026

What is CVE-2026-55083?

The DHIS2 information system, a prominent tool for data capture and analytics, is susceptible to a remote code execution flaw due to unsafe Java deserialization processes. This vulnerability impacts versions 2.42.0 through 2.42.5.1 and versions 2.43.0 through 2.43.0.1. If exploited, it allows unauthorized users to execute arbitrary code on affected systems. Users are strongly advised to update to the patched versions 2.42.5.1, 2.43.0.1, or 2.44 to mitigate these risks.

Affected Version(s)

dhis2-core >= 2.42.0, < 2.42.5.1 < 2.42.0, 2.42.5.1

dhis2-core >= 2.43.0, < 2.43.0.1 < 2.43.0, 2.43.0.1

References

https://github.com/dhis2/dhis2-core/security/advisories/G...
x_refsource_CONFIRM
https://github.com/dhis2/dhis2-core/releases/tag/2.42.5.1
x_refsource_MISC
https://github.com/dhis2/dhis2-core/releases/tag/2.43.0.1
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.