CVE-2026-3967 Details

A critical remote code execution vulnerability exists in Alfresco Activiti versions through 7.19 and 8.8.0. The issue arises in the Process Variable Serialization System, specifically within the `SerializableType` class. The vulnerability allows for untrusted deserialization of Serializable objects sent via REST or Java APIs. These objects are stored in the database without proper validation and later deserialized using an unrestricted ObjectInputStream. This flaw enables attackers to execute arbitrary code by exploiting deserialization gadget chains commonly available in Activiti deployments, such as those from the Spring Framework, Jakarta Expression Language, and Apache Commons Collections.

Deactivate the Serializable variable type in the Activiti process engine configuration. Alternatively, use safer variable types, such as primitives or custom types with explicit class allowlists. For Java 9 and above, implement ObjectInputFilters to restrict deserialization, and for Java 8, enforce class whitelists in the deserialization process.