CVE-2026-7861

CriticalCVSS 9.8

Published: 07/09/2026(UTC)Updated: 09/09/2026(UTC)Translated: 09/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

25th percentile - higher than 25% of all known CVEs

Summary

Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Code Injection. This issue affects CSM versions before 8.0.3.

Risk Assessment

An attacker could exploit this vulnerability to execute arbitrary code in the application context, potentially leading to system compromise or data breach.

Recommendation

Immediately update CSM to version 8.0.3 or later, which includes the fix.

Other vulnerabilities in CSM (Customer Service Management)

CVE-2026-6377High
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Path Traversal. This issue affects CSM (Customer Service Management): from 6.8.9 before 8.0.3.

Original NVD description (English source)

Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Code Injection. This issue affects CSM (Customer Service Management): before 8.0.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS