CVE-2026-62131

Summary

Zoho Flow versions <= 2.14.5 contain an unauthenticated PHP Object Injection vulnerability (CWE-502) in which maliciously crafted serialized objects can be deserialized by the application, leading to arbitrary code execution or data manipulation without authentication.

Exploitability

Exploitation is straightforward for attackers with network access to the vulnerable endpoint, as no authentication or user interaction is required.

Blast radius

Successful exploitation could lead to full system compromise including remote code execution, unauthorized data access, and service disruption across any environment where Zoho Flow is deployed.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Zoho Flow version 2.14.6 or later, which contains the official fix for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.