References https://www.twcert.org.tw/tw/cp-132-10742-45b13-1.html https://www.twcert.org.tw/en/cp-139-10743-9a952-2.html https://www.cve.org/CVERecord?id=CVE-2026-3422 https://net.nthu.edu.tw/netsys/mailing:announcement:20260305_23?do=export_pdf https://cc.ncku.edu.tw/p/404-1213-294234.php?Lang=zh-tw https://olis.kmu.edu.tw/index.php/en-gb/notice/79-security/4446-ana20260309u https://github.com/advisories/GHSA-6942-jvg8-w9h4 https://www.linkedin.com/posts/dailycve_u-office-force-insecure-deserialization-activity-7436803028940275712--I6G
Related VulnerabilitiesPoCCVE-2017-7504: JBossMQ HTTP Invocation Layer (HTTPServerILServlet) - Unauthenticated Java DeserializationPoCCVE-2015-7501: Red Hat JBoss - Insecure DeserializationPoCCVE-2019-1003030: Jenkins Pipeline Groovy Plugin <=2.63 - Insecure DeserializationPoCCVE-2025-26399: SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCEPoCCVE-2026-58644: Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE金和OA /c6/JHSoft.Web.CostControl/Decompose/AjaxForCenterBudgetDecompose.ashx SQL 注入漏洞英華達|全家寶 Cloud - Insecure Direct Object ReferencePoCCVE-2024-42323: Apache HertzBeat < 1.6.0 - SnakeYAML Deserialization Remote Code ExecutionPoCdzzoffice-installer: DzzOffice - Installer Page ExposurePoCCVE-2026-35273: Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCEPoCCVE-2026-46725: TYPO3 ceselector Extension - Insecure Deserialization沛盛資訊|OMICARD EDM - Insecure Direct Object Reference金財通商務科技|Service Center - Insecure Direct Object Reference