{"id":"CVE-2026-12389","published":"2026-11-10T06:17:08.200","lastModified":"2026-11-10T06:17:08.200","description":"A vulnerability that could lead to a high privileged authenticated user performing a remote code execution attack.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://www.axis.com/dam/public/1a/bd/41/cve-2026-12389pdf-en-US-561248.pdf","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A deserialization vulnerability (CWE-502) allows a high-privileged authenticated user to execute arbitrary code remotely by exploiting unsafe deserialization of untrusted data. Though requiring elevated privileges, this flaw enables full system compromise including confidentiality, integrity, and availability impacts.","exploitability":"Exploitation requires a high-privileged authenticated session and knowledge of the vulnerable deserialization endpoint or flow; no public exploit exists.","blast_radius":"If exploited, an attacker with high privileges could fully compromise the affected system, potentially pivoting to other internal assets or exfiltrating sensitive data.","remediation":"No fixed version is published in the description; disable any non-essential deserialization functionality involving untrusted input and enforce strict input validation and allowlisting for all serialized objects.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","deserialization","cwe502","authenticated","high-privilege"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:50:46.924Z"}}