CVE-2026-62087: CWE-502 Deserialization of Untrusted Data in ThemeREX Equadio

This vulnerability (CVE-2026-62087) in ThemeREX Equadio (<= 1.1.4) is caused by unsafe deserialization of untrusted data, classified under CWE-502. It enables unauthenticated attackers to perform PHP Object Injection, potentially leading to remote code execution or other severe impacts. The CVSS v3.1 base score is 9.8, reflecting its critical severity with network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability.

Successful exploitation can result in complete system compromise including unauthorized code execution, data disclosure, and service disruption. The vulnerability does not require authentication or user interaction, increasing its risk. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to deserialization. Avoid using untrusted data in deserialization processes.