CVE Intelligence
Analysis AI-assisted

CVE-2026-0773: Upsonic Deserialization of Untrusted Data Remote Code Execution

CVE-2026-0773 is a critical deserialization of untrusted data flaw (CWE-502) in Upsonic, reported by the Zero Day Initiative. According to the record, it lets a remote attacker run code in the service account context without authentication through the add_tool endpoint. The record lists no fixed version, so administrators should restrict exposure of the endpoint and check the vendor for updates.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-0773 is a deserialization of untrusted data flaw (CWE-502) in Upsonic, as described in the ZDI advisory. The issue is located in the add_tool endpoint, which listens on TCP port 7541 by default. The record states that no authentication is required to reach the flaw.

Impact

  • Remote attackers may execute arbitrary code on affected installations.
  • Code runs in the context of the service account.
  • The record assigns a CVSS base score of 9.8 (critical), with high confidentiality, integrity and availability impact.

Affected products and versions

  • Product: Upsonic Upsonic.
  • Affected version listed in the record: 0.52.1.
  • Fixed versions: none are listed in the record. This does not confirm that no fix exists, so fix status is unknown.

Exploitation status

The record shows the CISA KEV catalog entry as not listed. No confirmed active exploitation appears in the sources consulted. The SSVC data in the record marks exploitation as 'none' and automatable as 'yes'. The EPSS probability is 0.01438 with a percentile of 0.72961.

Remediation and mitigation

  • Identify all Upsonic installations and check whether any run version 0.52.1.
  • Check the vendor and the ZDI advisory for a fixed release, since none is listed in the record.
  • Until a fix is applied, restrict network access to the add_tool endpoint port (TCP 7541 by default) so that only trusted hosts can reach it.
  • Do not expose the service directly to the internet.

Detection guidance

  • Review network telemetry for unexpected inbound connections to TCP 7541 from untrusted sources.
  • Monitor the service for unexpected child processes or outbound connections originating from the Upsonic service account.
  • Keep and review logs for the add_tool endpoint, looking for requests from unknown clients.

Limitations of the available information

The record does not list fixed versions, vendor patches, or affected version ranges beyond 0.52.1, so whether other versions are affected is unknown. The EPSS date in the record (2026-10-23) is later than the publication date and should be verified. Details of the vulnerable code path are limited to the ZDI summary.

Frequently asked questions

Does CVE-2026-0773 require authentication to exploit?

According to the record, no authentication is required to reach the vulnerable add_tool endpoint.

Is there a fixed version of Upsonic for this flaw?

The record lists no fixed version. Fix status is unknown, so check the vendor and the ZDI advisory for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.