Zero Radar
← feed
CriticalVulnerabilityCVE-2026-54860updated 29 Oct 2026, 20:04 UTC

Ozisti: attackers can run code on the server without logging in

Attackers who have never logged in can send specially crafted data that makes the website's software run commands they choose. This can let them take over the site and the data it holds.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerNo login or account needed
  2. 2Crafted requestMalicious serialized data sent to the site
  3. 3Ozisti appUnsafely processes the untrusted data
  4. 4ServerInjected code runs with server rights
  5. ResultAttacker controls the server

What happened

Ozisti versions up to and including 1.1.10 have an unauthenticated PHP object injection flaw, where untrusted input is unsafely deserialized.

Why it is dangerous: A successful attacker could gain control of the server, read or change data, and use the site for further attacks. Any internet-facing Ozisti installation is at risk.

Are you affected?

You are affected if you run Ozisti version 1.1.10 or earlier, reachable from the internet.

Ozisti <= 1.1.10

What to do

  1. Check your Ozisti version and confirm whether it is 1.1.10 or earlier
  2. Check the vendor or GitHub advisory GHSA-gg4p-wc2h-c779 for a fixed release and update as soon as one is available
  3. Restrict access to the Ozisti installation or take it offline until patched
  4. Review logs for unusual requests if the system was exposed

Timeline

  1. 29 Oct 2026, 16:18 UTC
    Publicly disclosed
  2. 29 Oct 2026, 16:18 UTC
    Reported by NVD · NVD
  3. 29 Oct 2026, 16:20 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 20:04 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-54860 · GHSA-gg4p-wc2h-c779
CVSS
9.8 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
29 Oct 2026, 16:18 UTC
On Zero Radar
29 Oct 2026, 16:20 UTC (2 min after disclosure)
Last change
29 Oct 2026, 20:04 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Ozisti: attackers can run code on the server without logging in · Zero Radar