CVE-2026-93941: Deserialization of Untrusted Data in ThemeREX Group Edema

The vulnerability CVE-2026-93941 in ThemeREX Group Edema involves deserialization of untrusted data, which enables object injection attacks. This flaw affects all versions from 0 through 1.2.2.2 inclusive. Exploitation can lead to complete compromise of the affected system's confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.8, reflecting a critical severity level with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability can result in full compromise of the affected system, including unauthorized disclosure of information, modification or destruction of data, and disruption of service. The critical CVSS score of 9.8 reflects the high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Users should monitor ThemeREX Group's advisories for updates and apply patches once available. Until then, consider restricting network access to the affected service and applying any recommended temporary mitigations from the vendor.