Cyber Posture

CVE-2023-49886

Critical

Published: 06 October 2025

Published
06 October 2025
Modified
16 October 2025
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0133 80.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2023-49886 is an unsafe Java deserialization vulnerability (CWE-502) affecting IBM Standards Processing Engine version 10.0.1.10. Published on 2025-10-06, it enables a remote attacker to execute arbitrary code on the system by sending specially crafted input that triggers the deserialization flaw.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is highly severe and exploitable over the network with low complexity, no privileges, and no user interaction required. Any unauthenticated remote attacker can target exposed instances of the affected software to achieve full remote code execution, potentially compromising confidentiality, integrity, and availability.

Mitigation details are provided in the IBM security advisory at https://www.ibm.com/support/pages/node/7247179.

Details

CWE(s)
CWE-502

Affected Products

ibm
transformation extender advanced
10.0.1

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CVE-2023-49886 is an unauthenticated remote code execution vulnerability in a public-facing application via unsafe Java deserialization, directly enabling T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References