CVE-2026-107104 Unsafe Deserialization Vulnerability in Manacle Technologies ERP System
Unauthenticated remote attackers can execute arbitrary code or modify data via unsafe deserialization in the Manacle Technologies ERP system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-107104?
CVE-2026-107104 is a critical unsafe deserialization vulnerability in Manacle Technologies Multi-tenant ERP System, published on 7 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system.
Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code, manipulate application data or perform other unintended actions on the targeted system.
Weakness: CWE-502
Which versions are affected by CVE-2026-107104?
How do I fix CVE-2026-107104?
No fix has been published for CVE-2026-107104 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-107104 being exploited?
There is no known exploitation of CVE-2026-107104 in the wild and no public exploit code.
Sources
Also known as GHSA-2v3v-q9xj-82fm.