Description
A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/parallel/SocketData.java. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible.
Published: 2026-08-19
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the SocketData component of SPLWare esProc, where the method ObjectInputStream.readUnshared is invoked on data received from external sources without proper validation. This design allows an attacker to send a manipulated byte stream that is deserialized by the application. The CVE description states that remote exploitation is possible, and it is inferred that such deserialization may enable arbitrary code execution, though the active impact is not explicitly confirmed.

Affected Systems

All releases of SPLWare esProc up to and including version 20260507 contain this flaw. It is located in src/main/java/com/scudata/parallel/SocketData.java. Users running any of these versions should seek vendor guidance, consider upgrading to a newer release if available, or implement network-level controls to mitigate risk.

Risk and Exploitability

The CVSS score of 6.9 denotes moderate severity, and the EPSS score is not available for this CVE. It is not listed in the CISA KEV catalog. The flaw is remotely exploitable via network access to the esProc service, allowing an attacker to send crafted serialized input that is processed by ObjectInputStream.readUnshared. It is inferred that this could lead to execution of arbitrary code or other unintended behavior, but the CVE description does not provide explicit evidence of such outcomes.

Generated by OpenCVE AI on August 19, 2026 at 07:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Verify whether a newer esProc release contains a fix for this deserialization issue and, if available, upgrade accordingly.
  • Restrict network exposure of the esProc service by limiting access to trusted IP ranges or placing the service behind a firewall to reduce the attack surface.
  • Deploy monitoring or intrusion detection that detects suspicious deserialization activity or unusual network traffic on the esProc service.

Generated by OpenCVE AI on August 19, 2026 at 07:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 02:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/parallel/SocketData.java. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible.
Title SPLWare esProc SocketData.java ObjectInputStream.readUnshared deserialization
First Time appeared Splware
Splware esproc
Weaknesses CWE-20
CWE-502
CPEs cpe:2.3:a:splware:esproc:*:*:*:*:*:*:*:*
Vendors & Products Splware
Splware esproc
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Splware Esproc
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-19T01:45:09.722Z

Reserved: 2026-08-18T18:32:32.839Z

Link: CVE-2026-75987

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-19T02:16:13.173

Modified: 2026-08-19T02:16:13.173

Link: CVE-2026-75987

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-19T08:00:04Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-502

    Deserialization of Untrusted Data