CVE-2026-19826
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
In alldatacenter alldata up to version 0.6.8, a deserialization vulnerability exists in the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java in the xxl-rpc Listener component. The manipulation results in deserialization, and the attack can be performed remotely. The exploit is now public and may be used. The project closed the issue report as 'not planned' without further explanation.
Risk Assessment
A remote attacker can exploit the vulnerability to execute arbitrary code on the server, potentially leading to full system compromise, data theft, or service disruption. The public exploit increases the risk of attacks.
Recommendation
Upgrade alldatacenter alldata to a version newer than 0.6.8 if available. If not, restrict access to the xxl-rpc service and monitor logs for suspicious activity.
Original NVD description (English source)
A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The project closed the issue report as "not planned" without any further explanation.