CVE-2026-107104: CWE-502 Deserialization of untrusted data in Manacle Technologies Multi-tenant ERP System

This vulnerability arises from unsafe deserialization of untrusted data in the Multi-tenant ERP System by Manacle Technologies. Because the deserialization process does not properly validate or sanitize user input, an unauthenticated remote attacker can supply maliciously crafted data to the affected functionality. Exploiting this flaw can result in arbitrary code execution, unauthorized manipulation of application data, or other unintended consequences within the targeted system. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality and integrity.

An attacker exploiting this vulnerability can execute arbitrary code remotely without authentication, potentially leading to full compromise of the affected ERP system. This includes unauthorized data manipulation and other malicious actions, severely impacting system confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, restrict access to the vulnerable functionality and monitor for suspicious activity related to deserialization inputs.