The vulnerability arises from unsafe deserialization of user-controlled data, enabling an unauthenticated remote attacker to craft malicious payloads that are processed by the ERP system. Successful exploitation can lead to arbitrary code execution, data manipulation, or other unintended actions, compromising confidentiality, integrity, and availability of the application. This flaw corresponds to CWE-502.

Manacle Technologies Multi‑tenant ERP System versions unspecified, all affected. The issue is reported for the multi‑tenant ERP product without a specific version range; organizations using any deployment of this system should treat it as vulnerable until a vendor patch is available.

The CVSS score of 9.3 indicates critical severity, and although EPSS is not available, the lack of an authentication requirement in the description means an attacker could exploit the flaw from any location with network access to the vulnerable API or web interface. The flaw has not been listed in CISA’s KEV catalog, yet its remote nature and severe impact raise the risk of widespread compromise if left unmitigated.