Loading story…
The OWASP Zed Attack Proxy (ZAP) ViewState add-on was found to contain an insecure Java deserialization flaw that can lead to arbitrary code execution inside the ZAP JVM. According to the advisory, versions before ViewState v4 deserialize attacker-controlled data from the javax.faces.ViewState HTTP response parameter when the Desktop UI renders the ViewState panel. The vulnerable JSFViewState.decode() path base64-decodes the value and passes it directly to Java deserialization without a filter, allowlist, or type restriction.
The issue can be triggered by a malicious or compromised proxied web server that returns a crafted serialized Java object in the response, causing code execution on the analyst’s system running ZAP. ZAP disclosed the vulnerability and released ViewState version 4, with the corresponding release disabling JSF support and raising the minimum required ZAP version to 2.17.0. Organizations using ZAP for testing should identify installations with the ViewState add-on below v4 and upgrade promptly, especially where users proxy untrusted applications through the Desktop UI.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-24, ZAP published a security notice describing a Java deserialization vulnerability in the ViewState add-on. The flaw affects versions before 4 and can allow arbitrary code execution when a malicious proxied server supplies a crafted javax.faces.ViewState value that is deserialized in the ZAP JVM.
On 2026-06-24, the ZAP project published the ViewState add-on version 4 release. The release notes state that support for JSF was disabled, which aligns with the remediation for the vulnerable ViewState handling.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
vulncheck.com
Open sourcezaproxy.org
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Gabriel Lawrence and Chris Frohoff detailed how applications that deserialize attacker-controlled objects can be manipulated to alter state, bypass business logic, or execute arbitrary code. The issue spans Java, Python, PHP, Ruby, and JSF implementations where serialized data is accepted through cookies, tokens, caches, RPC streams, or client-side ViewState values. Examples include tampering with Java and Python serialized cookies, abusing PHP serialized objects in Memcache, modifying JSF ViewState expression-language data, and targeting Java deserialization exposed through MyFaces ViewState and RMI Registry. The presentation demonstrated tools such as `ysoserial` and ViewStateMesser and recommends eliminating open-ended deserialization, allowlisting permitted classes and types, authenticating data before deserialization, hardening exposed services, and retaining session state server-side where feasible.
Aug 29, 2026
Google Cloud's Mandiant Threat Intelligence reported exploitation of the KnowledgeDeliver platform through an ASP.NET **ViewState deserialization vulnerability**, indicating attackers were able to abuse insecure server-side handling of serialized state data to achieve code execution on exposed systems. The issue affects deployments where ViewState protections were improperly configured or bypassed, turning a common web application mechanism into an entry point for compromise. The report highlights the risk to organizations running internet-facing KnowledgeDeliver instances, where successful exploitation could allow unauthorized access, remote command execution, and follow-on intrusion activity. Defenders were urged to identify exposed systems, review application and web server logs for suspicious requests tied to ViewState processing, validate hardening of ASP.NET cryptographic settings, and apply vendor guidance or mitigations to prevent further exploitation.
Jul 12, 2026
ZITADEL, an identity and access management platform, has been found to contain critical vulnerabilities, including CVE-2025-67494 (CVSS 9.3) and CVE-2025-67495, that expose users to significant security risks. The flaws allow for server-side request forgery (SSRF), internal breaches, and account hijacking through DOM-based cross-site scripting (XSS) in the Zitadel V2 login interface. Successful exploitation could enable attackers to compromise user accounts and potentially gain unauthorized access to internal resources. Security advisories highlight the severity of these issues, urging organizations using ZITADEL to apply patches and mitigations immediately. The vulnerabilities underscore the importance of robust input validation and prompt security updates in identity management solutions to prevent exploitation and protect sensitive authentication infrastructure.
Jun 29, 2026