The vulnerability CVE-2026-28074 affects ThemeREX Pizza House up to version 1.4.0 and is caused by unsafe deserialization of untrusted data, enabling object injection attacks. This can allow remote attackers to execute arbitrary code or cause denial of service. The CVSS 3.1 base score of 9.8 reflects its critical nature with network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently provided.

Successful exploitation of this vulnerability could lead to full system compromise, including unauthorized code execution, data manipulation, and service disruption. Given the critical CVSS score and the nature of object injection, the impact is severe with potential for complete loss of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting features that process serialized data from untrusted sources if possible. Monitor vendor channels for updates and apply patches promptly once available.