VULNERABILITY INTELLIGENCE

CVE-2026-76834

CVSS score9.2 CRITICAL

EPSS probability2.42%

CISA KEVNot currently listed

Published2026-09-17

Last modified2026-09-23

Description

b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array object check in param_check_serialized_array() fails to reject payloads with negative integer array keys. Unauthenticated attackers can submit crafted serialized PHP objects via POST r... .