The vulnerability identified as CVE-2026-22454 affects ThemeREX Solaris versions up to 2.5 and involves deserialization of untrusted data, which allows an attacker to perform object injection. This can lead to remote code execution or other severe impacts due to the manipulation of serialized objects. The CVSS 3.1 base score of 9.8 reflects the critical nature of this vulnerability, with an attack vector over the network, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code, manipulate data, or cause denial of service on affected ThemeREX Solaris systems up to version 2.5. This results in a complete compromise of the system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected systems and monitor for suspicious activity related to object deserialization. Avoid processing untrusted serialized data if possible.