CVE-2026-34838 is a critical insecure deserialization vulnerability (CWE-502) affecting Group-Office versions prior to 6.8.156, 25.0.90, and 26.0.12. An authenticated attacker can exploit this flaw with low complexity by injecting a serialized object into a setting string, enabling arbitrary file write and leading directly to Remote Code Execution (RCE) on the server. Rated 9.9 CRITICAL (CVSS:3.1), this network-exploitable vulnerability poses a severe risk to confidentiality, integrity, and availability. Although there is no evidence of active exploitation or public exploit code, the vulnerability has received community attention. Immediate patching to the latest versions is strongly recommended.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 6.8.156CPE matchmatch criteria | cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:* | ||
>= 25.0.1, < 25.0.90CPE matchmatch criteria | cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:* | ||
>= 26.0.1, < 26.0.12CPE matchmatch criteria | cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 1.0 Bluesky, 0.5 Mastodon, and 1.6 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.