CVE-2026-50076
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
In the Apache Fory fory-core Java SDK before version 1.1.0, there is a deserialization of untrusted data vulnerability in the Java replace-resolve path. A remote attacker can bypass class registration, TypeChecker, and DisallowedList checks and invoke readResolve/readExternal hooks via crafted Fory serialized data.
Risk Assessment
An attacker can remotely execute arbitrary code in the application context, leading to full system compromise and loss of confidentiality, integrity, and availability.
Recommendation
Upgrade Apache Fory fory-core Java SDK to version 1.1.0 or later immediately.
Original NVD description (English source)
Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks and invoke classpath-present readResolve/readExternal hooks via crafted Fory serialized data. Users are recommended to upgrade to version 1.1.0 or later, which fixes this issue.