{"id":"CVE-2026-55083","published":"2026-10-01T19:17:21.330","lastModified":"2026-10-02T18:53:46.583","description":"DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution (RCE) via unsafe Java deserialization. This issue has been patched in versions 2.42.5.1, 2.43.0.1, and 2.44.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://github.com/dhis2/dhis2-core/releases/tag/2.42.5.1","tags":[]},{"url":"https://github.com/dhis2/dhis2-core/releases/tag/2.43.0.1","tags":[]},{"url":"https://github.com/dhis2/dhis2-core/security/advisories/GHSA-3fr2-wvqx-cmr5","tags":[]}],"exploitRefs":[{"url":"https://github.com/dhis2/dhis2-core/releases/tag/2.42.5.1","tags":[]},{"url":"https://github.com/dhis2/dhis2-core/releases/tag/2.43.0.1","tags":[]},{"url":"https://github.com/dhis2/dhis2-core/security/advisories/GHSA-3fr2-wvqx-cmr5","tags":[]}],"hasPoc":true,"ai":{"summary":"DHIS2 is vulnerable to remote code execution via unsafe Java deserialization, allowing attackers to execute arbitrary code on the server.","exploitability":"Exploitation requires the ability to send maliciously crafted data to the affected endpoint, which could be difficult to achieve without access to the network or internal systems.","blast_radius":"If exploited, this vulnerability could result in full control of the DHIS2 server, leading to data loss, system compromise, and potential impact on downstream systems.","remediation":"Upgrade to DHIS2 version 2.42.5.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","java-deserialization","web","server"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-02T08:46:54.790Z"}}