Weakness

Insecure deserialization

Turning untrusted data back into program objects in a way that lets it run code.

Many languages can rebuild objects from stored or transmitted data. If an application does that with attacker-supplied data, crafted input can trigger code execution. It is a frequent root cause of remote code execution in Java and .NET enterprise software.

Insecure deserialization in the news

Grid Protection Alliance openPDC and openHistorian

CISA Advisories17d agoVulnerabilitiesIdentityCVE-2026-100730 CVE-2026-101022+4

The weakness behind it

Its CWE entry, with CVEs in the news, attacker techniques and the controls that stop it.

CWE-502Deserialization of Untrusted DataUntrusted bytes are turned back into live objects, which can trigger code during reconstruction.

AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.

Plain-language explainers written by SecurityTabs, matched to stories by name. All terms

Insecure deserialization in the news

Grid Protection Alliance openPDC and openHistorian

The weakness behind it

Related