CVE-2026-19826 describes a vulnerability in alldatacenter alldata up to version 0.6.8 affecting the Hessian2Input.readObject function in /serialize/impl/HessianSerializer.java of the xxl-rpc Listener component. The vulnerability allows remote attackers to perform deserialization attacks due to improper input validation or handling. The project has closed the issue report without planning a fix. Exploit code is publicly available, but no known active exploitation in the wild has been reported.

Successful exploitation of this vulnerability can lead to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). This means an attacker could potentially manipulate serialized data to cause unauthorized information disclosure, data modification, or service disruption remotely without authentication.

No official patch or fix is currently available as the project has closed the issue report as 'not planned'. Users should monitor the vendor or project advisories for any future updates. Until a fix is provided, consider restricting access to the vulnerable service or implementing network-level controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.