Zero Radar
← feed
CriticalVulnerabilityupdated 25 Oct 2026, 13:32 UTC

Parasoft Continuous Testing Platform: unsafe database restore lets outsiders run commands

Anyone who can reach the testing platform over the network may be able to make it run commands on the server without logging in. The flaw is in how the product restores database backups, which lets crafted data be turned into code that runs

1 source, unconfirmed
SeverityCriticalVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Attacker sends dataCrafted payload sent without logging in
  2. 2Restore path reachedDatabase restore endpoint accepts the data
  3. 3Unsafe deserializationData is turned into executable objects
  4. 4Commands executeJSP code runs as uid=1000
  5. ResultAttacker runs commands on the server

What happened

An anonymous deserialization flaw in the database restore path of the em web application (Tomcat 10.1.57, vendor container image) allows JSP command execution as uid=1000 in Parasoft Continuous Testing Platform 10.7.5-SNAPSHOT.

Why it is dangerous: A successful attacker gets command execution on the server with the platform's user rights, which can expose test data, credentials, and connected systems. Teams running this testing platform on reachable networks are at risk.

Are you affected?

You are affected if you run Parasoft Continuous Testing Platform 10.7.5-SNAPSHOT with the em web application exposed, as in the vendor's container image on Tomcat 10.1.57.

Parasoft Continuous Testing Platform 10.7.5-SNAPSHOT (em web application, Tomcat 10.1.57, vendor container image)

What to do

  1. Restrict network access to the Parasoft Continuous Testing Platform so only trusted users and hosts can reach it
  2. Check the vendor for a fixed release or official mitigation and apply it as soon as it is available
  3. Review the server for unexpected files or processes, and rotate any credentials stored on it

Timeline

  1. 20 Oct 2026, 18:50 UTC
    Publicly disclosed
  2. 20 Oct 2026, 18:50 UTC
    Reported by Full Disclosure · Full Disclosure

Sources 1 report, oldest first

Security researchers research teams and mailing lists

Technical details

ID
ZR-40fcbe06
Disclosed
20 Oct 2026, 18:50 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Parasoft Continuous Testing Platform: unsafe database restore lets outsiders run commands · Zero Radar