PT-2026-46269 · Unknown · Fory Fory-Core Java Sdk

R3Dw0Lfsec + 1 · CVE-2026-50076 · Published 2026-06-04 · Updated 2026-06-08

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Fory fory-core versions prior to 1.1.0

Description Deserialization of untrusted data in the Java replace-resolve path on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks. By using crafted Fory serialized data, an attacker can invoke readResolve() and readExternal() hooks present on the classpath.

Recommendations Upgrade to version 1.1.0 or later.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-50076

GHSA-8F39-V287-78JF

Affected Products

Fory Fory-Core Java Sdk

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-50076 · Security Note
• https://fory.apache.org/security · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8f39-v287-78jf · Vendor Advisory
• https://github.com/apache/fory · Note
• https://twitter.com/oss_security/status/2063626373084700726 · Twitter Post
• https://t.me/CVEtracker/55855 · Telegram Post
• https://twitter.com/AndreGironda/status/2062591324097019983 · Twitter Post
• http://openwall.com/lists/oss-security/2026/06/04/4 · Note
• https://twitter.com/UpwindMDR/status/2062612613704438106 · Twitter Post
• https://twitter.com/dailycve/status/2064002651931525422 · Twitter Post
• https://t.me/cveNotify/166476 · Telegram Post