CVE-2026-24892 is an unsafe PHP deserialization vulnerability affecting openITCOCKPIT Community Edition 5.3.1 and earlier. It allows for unrestricted unserialization of changelog data, creating a latent PHP object injection vulnerability. With a CVSS score of 8.8 (High), this flaw could lead to remote code execution if future code changes or plugins introduce object values into the affected data path, requiring only low privileges and no user interaction. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.4.0CPE matchmatch criteria | cpe:2.3:a:it-novum:openitcockpit:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.