VulnSocial

CVE-2026-11860Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 5 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. This allows attackers to tamper with serialized payloads in transit and inject malicious objects. Because deserialization is performed without proper validation or class restrictions, crafted payloads can trigger dangerous magic methods (e.g., __wakeup() and __destruct()) and leverage gadget chains, resulting in arbitrary code execution. Exploitation is triggered automatically when an administrator accesses the admin panel. When successfully exploited, this vulnerability allows attackers to execute arbitrary code on the server via manipulated serialized data transmitted over an unprotected channel. This issue was mitigated by limiting the communication to HTTPS in a patch for version 6.8 published on 14.05.2026, deployments without this patch remain vulnerable.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-94CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 5 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 5 signals
  • Disclosure: 3 classified signals
  • General: 1 classified signal
  • 5 total mentions across 1 day

Deep dive

Activity timeline5 mentions / 1d
01345Mentions · 2026-06-15: 5Patch / Workaround · 2026-06-15: 1Technical Details · 2026-06-15: 506-15
Signal classification3 categories
Disclosure
360.0%
General
120.0%
Patch
120.0%
Referenced assets4 URLs
Full discourse5 posts
  • Rahmi Demir ⭐⭐⭐⭐⭐@rahmid3mir
    Patch

    🚨 GÜVENLİK BÜLTENİ: Quick.CMS'de Kritik Uzaktan Kod Yürütme (RCE) Zafiyeti (CVE-2026-11860) Merhaba #Brolyz, İçerik yönetim sistemlerini (CMS) yakından ilgilendiren kritik bir güvenlik açığı ortaya çıktı. VulDB ve CERT Polska tarafından raporlanan, OpenSolution tarafından geliştirilen Quick.CMS yazılımındaki CVE-2026-11860 numaralı zafiyet, CVSS 3.0'a göre 9.8 (Kritik) puan aldı. Açık, özellikle web altyapısını bu sistem üzerine kuran #Orta ve küçük ölçekli işletmeler için ciddi risk oluşturuyor. 📌 Zafiyetin Özeti Açık, Quick.CMS'in HTTP üzerinden gelen kullanıcı kontrollü verileri bütünlük veya kimlik doğrulaması yapmadan deserialize etmesinden (CWE-502) kaynaklanıyor. Saldırganlar, ağ trafiğine müdahale ederek (MitM) serileştirilmiş verileri değiştirebilir ve zararlı nesneler enjekte edebilir. Sınıf veya yapı kısıtlaması bulunmadığından, PHP'nin __wakeup() ve __destruct() #Gibi sihirli metotları tetiklenebilir. Sömürü, bir yöneticinin admin paneline giriş yapmasıyla arka planda çalışabiliyor. ⚠️ Riskler (CVSS: 9.8) • Uzaktan ve kimlik doğrulama gerektirmeden kod çalıştırma (RCE) • Web sunucusunun ve verilerin ele geçirilmesi • Kurumsal ağ içerisinde yatay hareket (lateral movement) • Sistem bütünlüğü ve gizliliğinin ihlali 🛠️ Çözüm ve Öneriler 1️⃣ Acil güncelleme: OpenSolution'ın 14 Mayıs 2026'da yayımladığı ve iletişimi HTTPS ile sınırlandıran 6.8 sürümüne yükseltin. 2️⃣ HTTPS zorunluluğu: CMS trafiğinin yalnızca TLS/HTTPS üzerinden gerçekleştiğinden emin olun, HTTP erişimini kapatın veya yönlendirin. 3️⃣ WAF güncellemesi: Web Uygulama Güvenlik Duvarı kurallarını deserialization saldırıları ve PHP gadget chain yüklerine karşı güncelleyin. Web altyapılarınızı güncel tutmayı unutmayın. Güvenli haftalar dilerim. 🛡️

    Post summary

    The bulletin reports CVE‑2026‑11860, a critical PHP deserialization RCE in Quick.CMS, and advises updating to version 6.8, enforcing HTTPS, and tightening WAF rules.

    0005075
    350 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-11860 Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. This allows attackers to tamper with serialized p… https://www.cve.org/CVERecord?id=CVE-2026-11860 ----- Traducción: CVE-2026-11860 Qui… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-11860, describing a deserialization flaw in Quick.CMS over plaintext HTTP that could let attackers tamper with serialized data, but provides no PoC, exploit, or patch details.

    0000015
    79 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-11860 Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. This allows attackers to tamper with serialized p… https://www.cve.org/CVERecord?id=CVE-2026-11860

    Post summary

    The text provides a disclosure of a deserialization vulnerability in Quick.CMS, detailing how unauthenticated HTTP data can be tampered with, without presenting any PoC, exploit, or mitigation.

    00000179
    57.6K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-11860 Unsafe Deserialization Remote Code Execution in Quick.CMS via HTTP https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-11860

    Post summary

    The entry provides minimal details on CVE‑2026‑11860, noting an unsafe deserialization RCE in Quick.CMS via HTTP, but lacks PoC, exploit, patch info, or evidence of active exploitation.

    0000045
    4.0K followersView on X
  • Israel@f1tym1
    Disclosure

    Vulnerability in Quick.CMS software https://ift.tt/o1Ruv6T Deserialization of Untrusted Data vulnerability (CVE-2026-11860) has been found in Quick.CMS software. Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon co…

    Post summary

    A new deserialization of untrusted data vulnerability (CVE‑2026‑11860) has been announced for Quick.CMS software, with no mention of PoC, exploit code, active exploitation, or patch.

    0000047
    996 followersView on X

Explore more

Back to dashboard