CVE-2026-84834: CWE-502 Deserialization of Untrusted Data in eyecix JobSearch

This vulnerability, classified as CWE-502 (Deserialization of Untrusted Data), affects eyecix JobSearch software versions up to and including 3.2.0. It enables an attacker to perform unauthenticated PHP object injection, potentially resulting in complete confidentiality, integrity, and availability compromise. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported.

Successful exploitation can lead to full system compromise including unauthorized data access, modification, and service disruption. The vulnerability is remotely exploitable without authentication or user interaction, making it highly dangerous.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected application and monitor for suspicious activity related to PHP object injection attempts.