CERT24CVE-2026-57527 — Insecure deserialization in the ZAP ViewState add-on via JSFViewState.decode()Loading data…
CERT24Threat Observatory
Period

CVE-2026-57527 — Insecure deserialization in the ZAP ViewState add-on via JSFViewState.decode()

The Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability. A response containing a malicious serialized Java object can lead to arbitrary code execution in the ZAP JVM when the Desktop UI renders the ViewState panel.

← Back to intelligence

CVE-2026-57527 — Insecure deserialization in the ZAP ViewState add-on via JSFViewState.decode()

The Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability. A response containing a malicious serialized Java object can lead to arbitrary code execution in the ZAP JVM when the Desktop UI renders the ViewState panel.