CVE-2026-87930 describes a deserialization of untrusted data vulnerability in MaxSite CMS up to version 109.6. The application unserializes the ci_session cookie without restricting allowed classes, enabling attackers to inject arbitrary PHP objects. Because the encryption key is hardcoded, attackers can forge valid session cookies to trigger magic methods within these objects. This can corrupt the application state or potentially lead to remote code execution if exploitable gadget classes exist in the codebase. No official patch or remediation level is currently indicated, and no known exploits are reported in the wild.

An unauthenticated attacker can exploit this vulnerability to inject malicious PHP objects via a forged session cookie. This can result in corruption of the application state or remote code execution, posing a critical risk to the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting the use of unserialize() on untrusted data such as session cookies, or implement class whitelisting if possible. Monitor vendor channels for updates and apply patches promptly once released.