CVE-2026-57527: insecure deserialization RCE

CISO Take

The ZAP ViewState add-on (pre-v4) blindly deserializes the javax.faces.ViewState HTTP response parameter with ObjectInputStream.readObject() — no filter, no allowlist — so any server a tester proxies through can hand back a malicious Java object and get code execution inside the ZAP JVM. This isn't an AI model or pipeline flaw; it's a supply-chain risk to the security tooling that AI/product security teams run every day, including when red-teaming AI-powered web apps, chatbot front-ends, or agent UIs via ZAP. A public PoC exists and CISA rates it TRACK, but EPSS sits at 0.46% (top 63rd percentile) with no KEV listing and no Nuclei template, so it reads as a real but not yet mass-exploited threat — the realistic exposure is a malicious or compromised test target turning a pentester's own workstation into the entry point. Upgrade the ViewState add-on to v4+ immediately, and until confirmed, treat any engagement against untrusted or third-party-hosted targets as hostile to the tester's own machine.

Sources: NVD EPSS CISA SSVC zaproxy.org vulncheck.com

What is the risk?

CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/C:H/I:H/A:H) reflects a network-reachable, low-complexity, no-privilege exploit chain, gated only by requiring the analyst to open the ViewState panel on a malicious response. Exploitation likelihood is moderate rather than imminent: EPSS is low (0.46%, top 63rd percentile), it is not in CISA KEV, and there is no Nuclei scanning template in the wild, but a working PoC is publicly available, which materially lowers the bar for a motivated attacker who controls (or compromises) a server being tested. The realistic risk population is narrow — security engineers and pentesters actively using ZAP's Desktop UI with the ViewState add-on against untrusted or adversary-influenced targets — but the impact for that population is full compromise (C:H/I:H/A:H) of the analyst's workstation.

How does the attack unfold?

Malicious response delivery

A server the analyst is proxying through (compromised, malicious, or adversary-controlled) returns an HTTP response with a crafted javax.faces.ViewState parameter containing a serialized malicious Java object.

Unsafe deserialization

The analyst opens ZAP Desktop UI's ViewState panel, triggering JSFViewState.decode() to base64-decode and pass the value directly to ObjectInputStream.readObject() with no filter or allowlist.

Arbitrary code execution

The deserialization gadget chain executes attacker-controlled code within the ZAP JVM process on the analyst's workstation.

Impact / pivot

The attacker gains a foothold on the security team's machine, enabling theft of credentials, assessment data, or lateral movement into other systems used for AI application security testing.

Malicious response delivery

A server the analyst is proxying through (compromised, malicious, or adversary-controlled) returns an HTTP response with a crafted javax.faces.ViewState parameter containing a serialized malicious Java object.

Unsafe deserialization

The analyst opens ZAP Desktop UI's ViewState panel, triggering JSFViewState.decode() to base64-decode and pass the value directly to ObjectInputStream.readObject() with no filter or allowlist.

Arbitrary code execution

The deserialization gadget chain executes attacker-controlled code within the ZAP JVM process on the analyst's workstation.

Impact / pivot

The attacker gains a foothold on the security team's machine, enabling theft of credentials, assessment data, or lateral movement into other systems used for AI application security testing.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 51% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Upgrade the ZAP ViewState add-on to version 4 or later immediately (fixed in https://github.com/zaproxy/zap-extensions/releases/tag/viewstate-v4). 2) Until patched, avoid opening the ViewState panel on responses from untrusted, adversary-influenced, or newly-onboarded targets, including AI web apps under assessment that haven't been vetted. 3) Run ZAP Desktop UI in an isolated, disposable environment (VM/ephemeral container, no persistent credentials or sensitive network access) for any external or third-party engagement. 4) Detection: monitor for unexpected child processes or outbound connections spawned by the ZAP Java process, and audit ZAP add-on versions across all security team workstations. 5) No CISA KEV or Nuclei template exists yet, so this is a priority patch rather than an emergency incident-response trigger.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Plugin

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

MANAGE 2.3 - Third-party risks and tools used in AI system operation are regularly monitored

Frequently Asked Questions

What is CVE-2026-57527?

The ZAP ViewState add-on (pre-v4) blindly deserializes the javax.faces.ViewState HTTP response parameter with ObjectInputStream.readObject() — no filter, no allowlist — so any server a tester proxies through can hand back a malicious Java object and get code execution inside the ZAP JVM. This isn't an AI model or pipeline flaw; it's a supply-chain risk to the security tooling that AI/product security teams run every day, including when red-teaming AI-powered web apps, chatbot front-ends, or agent UIs via ZAP. A public PoC exists and CISA rates it TRACK, but EPSS sits at 0.46% (top 63rd percentile) with no KEV listing and no Nuclei template, so it reads as a real but not yet mass-exploited threat — the realistic exposure is a malicious or compromised test target turning a pentester's own workstation into the entry point. Upgrade the ViewState add-on to v4+ immediately, and until confirmed, treat any engagement against untrusted or third-party-hosted targets as hostile to the tester's own machine.

Is CVE-2026-57527 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-57527, increasing the risk of exploitation.

How to fix CVE-2026-57527?

1) Upgrade the ZAP ViewState add-on to version 4 or later immediately (fixed in https://github.com/zaproxy/zap-extensions/releases/tag/viewstate-v4). 2) Until patched, avoid opening the ViewState panel on responses from untrusted, adversary-influenced, or newly-onboarded targets, including AI web apps under assessment that haven't been vetted. 3) Run ZAP Desktop UI in an isolated, disposable environment (VM/ephemeral container, no persistent credentials or sensitive network access) for any external or third-party engagement. 4) Detection: monitor for unexpected child processes or outbound connections spawned by the ZAP Java process, and audit ZAP add-on versions across all security team workstations. 5) No CISA KEV or Nuclei template exists yet, so this is a priority patch rather than an emergency incident-response trigger.

What systems are affected by CVE-2026-57527?

This vulnerability affects the following AI/ML architecture patterns: AI/LLM web application security testing tooling (ZAP-based red-teaming of chatbot UIs, agent consoles, model-serving dashboards).

What is the CVSS score for CVE-2026-57527?

CVE-2026-57527 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.68%.

What is the AI security impact?

Affected AI Architectures

AI/LLM web application security testing tooling (ZAP-based red-teaming of chatbot UIs, agent consoles, model-serving dashboards)

Compliance Controls Affected

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter. The JSFViewState.decode() method base64-decodes the ViewState value and passes it directly to ObjectInputStream.readObject() without a deserialization filter, allowlist, or type restriction, causing the malicious object to be deserialized within the ZAP JVM when the Desktop UI renders the ViewState panel.

Exploitation Scenario

An AI security team red-teaming a customer's LLM-powered web application proxies their traffic through ZAP with the ViewState add-on enabled. The application (or an attacker who has compromised it, or a malicious bug-bounty/demo target the team is testing) returns an HTTP response containing a crafted javax.faces.ViewState parameter holding a malicious serialized Java object. When the analyst opens ZAP's Desktop UI to inspect that response in the ViewState panel, JSFViewState.decode() base64-decodes and deserializes the object via ObjectInputStream.readObject() with no filtering, triggering a gadget chain that executes arbitrary code inside the ZAP JVM — handing the attacker a foothold on the security team's own workstation, from which they can pivot to credentials, source code, or other systems used in the AI assessment pipeline.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data Primary CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.