The vulnerability CVE-2026-9497 affects changmingxie tcc-transaction versions 2.0 and 2.1.0. It arises from insecure deserialization in the Fastjson.parseObject function within the Fastjson AutoType REST API component. This flaw can be triggered remotely, enabling attackers to manipulate deserialization processes. The CVSS 4.0 score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability. The vendor has not provided any response or patch, and no known exploits are reported in the wild.

Successful exploitation could allow remote attackers to manipulate deserialization in the affected component, potentially leading to unauthorized code execution or other impacts related to deserialization vulnerabilities. However, the impact is rated medium with low to limited confidentiality, integrity, and availability impacts according to the CVSS 4.0 vector. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch is available, users should monitor for updates from the vendor or community. Until a fix is released, consider restricting access to the vulnerable API endpoints or disabling the Fastjson AutoType feature if feasible to reduce exposure.