This vulnerability (CVE-2026-27060) in ARMember Premium arises from unsafe deserialization of untrusted data, classified under CWE-502. It enables PHP Object Injection attacks in versions up to 7.0, allowing an attacker with network access and low privileges to execute arbitrary code remotely. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided, and no known exploits are reported in the wild.

Successful exploitation can lead to complete compromise of the affected system, including unauthorized disclosure of sensitive information, modification or destruction of data, and disruption of service. The vulnerability requires only low privileges and no user interaction, increasing its risk profile.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected application and monitor for suspicious activity related to deserialization. Avoid using untrusted data in serialization functions if possible.