CVE-2026-40044 is a deserialization vulnerability in pancho's Pachno 1.0.6. Attackers can write malicious serialized PHP objects to world-writable cache files with predictable names in the cache directory. These objects are unserialized during the framework bootstrap phase before authentication, allowing unauthenticated remote code execution. The vulnerability is critical with a CVSS 4.0 score of 9.3 and requires no privileges or user interaction to exploit. No patch or official remediation has been disclosed yet.

Successful exploitation allows unauthenticated attackers to execute arbitrary code on the affected system, potentially leading to full system compromise. The vulnerability occurs before authentication checks, increasing the risk and impact. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write permissions to cache directories to prevent unauthorized file creation. Monitor for unusual file writes in cache directories and consider applying temporary controls to limit access. Avoid exposing vulnerable versions to untrusted networks.