CVE-2023-54398Active Exploitation

MEDIUMCVSS 9.3 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-502

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Active Exploitation

1100.0%

Referenced assets1 URL

By indicator

https://pranithjain.qzz.io/threatintel/telegram?tab=leaks

Full discourse1 post

PJ@Npj844846d
Active Exploitation
🚨 Active exploitation detected for multiple high-severity vulnerabilities, including CVE-2026-69255 and CVE-2023-54398. Patch now to prevent attacks #ThreatIntel #CyberSecurity #InfoSec https://pranithjain.qzz.io/threatintel/telegram?tab=leaks
Post summary
The tweet reports that CVE‑2026‑69255 and CVE‑2023‑54398 are actively exploited, urging immediate patching to mitigate the threats.
00000147
75 followersView on X

Explore more

Back to dashboard