CVE-2026-63767 is a critical deserialization vulnerability affecting ktransformers through version 0.6.3. The SchedulerServer component listens on a ZMQ ROUTER socket bound to all interfaces and deserializes incoming pickle payloads without authentication or validation. Attackers can exploit malicious __reduce__ methods embedded in these crafted pickle payloads to execute arbitrary commands remotely as the server process. The vulnerability was fixed in commit def0f93, but no official patch release or advisory is provided in the data.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary shell commands on the server running ktransformers, potentially leading to full system compromise. The vulnerability affects all deployments exposing the SchedulerServer ZMQ ROUTER socket to untrusted networks. The CVSS 4.0 base score of 9.3 reflects high attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

A fix is available as indicated by the referenced commit def0f93, which addresses the vulnerability. Users should upgrade to a version including this commit or apply the fix manually. Since no official patch release or advisory is provided in the input data, users must verify the vendor's repository or contact the vendor for updated releases. Until patched, restrict network access to the SchedulerServer ZMQ ROUTER socket to trusted hosts only to mitigate exploitation risk.