Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through… (CVE-2026-93936)

CVE-2026-93936 is a deserialization of untrusted data vulnerability in ThemeREX Group IPharm ipharm that permits object injection attacks. This vulnerability affects all versions up to 1.2.4. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker to inject malicious objects during deserialization, potentially leading to full system compromise including unauthorized data access, modification, or denial of service. The critical CVSS score indicates severe impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to deserialization processes.