The vulnerability CVE-2025-26900 affects flexmls Flexmls® IDX through version 3.14.27 and involves deserialization of untrusted data, which allows an attacker to perform object injection. This can lead to remote code execution or other severe impacts due to the manipulation of serialized objects. The CVSS 3.1 base score is 9.8, reflecting an attack vector over the network, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in complete compromise of the affected system, including unauthorized disclosure, modification, or destruction of data, and disruption of service. Given the critical CVSS score and the nature of the vulnerability, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting network access to the affected application and monitor for suspicious activity related to object injection attempts. Avoid processing untrusted serialized data if possible.