CVE-2026-55083

9.1 CRITICALpublic exploit available

Published 2026-10-01 · Updated 2026-10-02

AI risk analysis

Summary: DHIS2 is vulnerable to remote code execution via unsafe Java deserialization, allowing attackers to execute arbitrary code on the server.
Exploitability: Exploitation requires the ability to send maliciously crafted data to the affected endpoint, which could be difficult to achieve without access to the network or internal systems.
Blast radius: If exploited, this vulnerability could result in full control of the DHIS2 server, leading to data loss, system compromise, and potential impact on downstream systems.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to DHIS2 version 2.42.5.1 or later.

rcejava-deserializationwebserver

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution (RCE) via unsafe Java deserialization. This issue has been patched in versions 2.42.5.1, 2.43.0.1, and 2.44.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-502

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.