CVE-2026-93936: Deserialization of Untrusted Data in ThemeREX Group IPharm

The vulnerability CVE-2026-93936 in ThemeREX Group's IPharm product involves deserialization of untrusted data, enabling object injection attacks. This flaw affects all versions from the initial release through version 1.2.4. Exploitation can result in complete compromise of the affected system's confidentiality, integrity, and availability. The vulnerability is remotely exploitable without authentication or user interaction, as indicated by the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No known exploits are reported in the wild, and no vendor patch or advisory information is provided in the input data.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure of sensitive information, modification or destruction of data, and disruption of service. The vulnerability is remotely exploitable without any privileges or user interaction, making it highly critical.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates and consider applying any available mitigations or workarounds once published.