CVE-2026-92785 affects Angel-ML angel through version 3.3.0. The vulnerability is due to insecure deserialization of untrusted setAlgoMetrics payloads using Kryo without enforcing class registration or allowlist validation. An unauthenticated attacker can exploit this by sending malicious serialized objects to the master RPC endpoint, leading to arbitrary class instantiation or denial of service via memory exhaustion. The CVSS 4.0 score is 9.2, indicating a critical severity with network attack vector, high attack complexity, and no privileges or user interaction required.

Successful exploitation can allow unauthenticated remote attackers to instantiate arbitrary classes on the server or exhaust the coordinator's memory resources, potentially causing denial of service or other impacts related to arbitrary code execution. This compromises the integrity and availability of the affected system.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the master RPC endpoint and monitor for suspicious serialized payloads if possible.