Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2022-05-03. Apply updates per vendor instructions.
Priority
LOW
Exploitation
ACTIVE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-05 | 1 | General1 |
| 2026-03-06 | 2 | Exploit1General1 |
| 2026-07-28 | 1 | PoC1 |
Security research on Liferay CE 7.0.3 GA4: pre-auth RCE as root (CVE-2020-7961 class) reproduced end-to-end, plus 16 more findings (Kimi k3 on raptor) https://github.com/dinosn/liferay-ga4-rce-research
Post summary
The researcher confirms a pre‑authentication remote code execution in Liferay CE 7.0.3 GA4 (CVE‑2020‑7961), provides proof‑of‑concept code on GitHub, and enumerates 16 additional findings.
Why Every Scanner Missed This RCE: Reviving CVE-2020–7961 On A 7 Year old Instance of Liferay https://medium.com/@yppip/why-every-scanner-missed-this-rce-reviving-cve-2020-7961-on-a-7-year-old-instance-of-liferay-a0d1c4af0738?source=rss------bug_bounty-5 #bugbounty #bugbountytips #bugbountytip
Post summary
The headline mentions CVE-2020-7961 but provides no further technical, exploit, or patch information, so it falls into a generic classification.
Working on a #bugbounty target with @_Zer0Sec_ and ended up going down a rabbit hole to re-exploit a 6 year old CVE that was seemingly a dead-end! Turns out it was not! Check it out here https://medium.com/@yppip/why-every-scanner-missed-this-rce-reviving-cve-2020-7961-on-a-7-year-old-instance-of-liferay-a0d1c4af0738
Post summary
The post showcases a revived Liferay RCE (CVE‑2020‑7961) and shares a Medium article with a successful re‑exploit, indicating the vulnerability remains exploitable and was overlooked by scanners.
"Why Every Scanner Missed This RCE: Reviving CVE-2020–7961 On A 7 Year old Instance of Liferay" by Phil #BugBounty #Cybersecurity #Hacking #InfoSec https://infosecwriteups.com/why-every-scanner-missed-this-rce-reviving-cve-2020-7961-on-a-7-year-old-instance-of-liferay-a0d1c4af0738
Post summary
The post title highlights that scanners overlooked a known Liferay RCE (CVE-2020‑7961) but provides no PoC, exploit code, patch, or technical details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | liferay | liferay_portal | - | - | - |