CVE-2026-7861: CWE-502 Deserialization of untrusted data in Next4Biz Information Technologies Inc. CSM (Customer Service Management)

This vulnerability (CVE-2026-7861) involves unsafe deserialization of untrusted data in Next4Biz CSM software prior to version 8.0.3. Exploiting this flaw enables an attacker to inject and execute arbitrary code remotely without authentication or user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack can be launched over the network with low complexity, no privileges, and no user interaction, resulting in complete confidentiality, integrity, and availability compromise.

Successful exploitation can lead to remote code execution, allowing attackers to fully compromise the affected system, including unauthorized data access, modification, and service disruption. Given the critical CVSS score of 9.8, the impact is severe.

A fix is available in Next4Biz CSM version 8.0.3 and later. Users should upgrade to version 8.0.3 or above to remediate this vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Patch status is confirmed by the version information indicating the vulnerability affects versions before 8.0.3.