PT-2026-45457 · Git · Anomali Match

Ivan Marković · CVE-2026-38950 · Published 2026-06-01 · Updated 2026-06-01

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ESA AnomalyMatch versions prior to 1.3.1

Description An issue allows attackers to execute arbitrary code through the use of crafted model checkpoint files. The problem occurs because affected components load model files from session directories using the torch.load() function with unrestricted deserialization, a process where data is converted back into an object without sufficient validation.

Recommendations Update ESA AnomalyMatch to version 1.3.1 or later.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-38950

Affected Products

Anomali Match

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/38xxx/CVE-2026-38950.json · Exploit
• 🔥 https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-38950 · Security Note
• https://osv.dev/vulnerability/CVE-2026-38950 · Vendor Advisory
• https://github.com/esa/AnomalyMatch/pull/9 · Note
• https://imlabs.info/research/security_advisory_esa_anomaly_match_unsafe_deserialization_cve_2026_38950_ivan_markovic_052026.html · Note