Uniong WebITR is vulnerable to insecure deserialization. The flaw allows authenticated remote attackers to leverage a hard‑coded cryptographic key to craft malicious serialized data for submission to the server, enabling arbitrary code execution. The weakness is classified as CWE‑502, which represents unacceptable deserialization practices that can give attackers far‑reach privileges.

All Uniong WebITR installations running a version prior to 2_1_0_36 are affected. The vendor recommends updating to version 2_1_0_36 or later to resolve the deserialization issue.

The vulnerability carries a CVSS score of 8.7, indicating a high severity risk. However, the EPSS score is less than 1 %, suggesting a low current exploitation probability. It is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the application and the ability to submit crafted serialized payloads, with the attacker controlling the cryptographic key.