References https://www.twcert.org.tw/tw/cp-132-10256-14d55-1.html https://libinfo.fgu.edu.tw/zh_tw/news/-%E6%BC%8F%E6%B4%9E%E9%A0%90%E8%AD%A6-%E9%81%94%E7%85%AC%E7%A7%91%E6%8A%80%EF%BD%9CWinMatrix3-Insecure-Deserialization-53883548 https://cc.ncku.edu.tw/p/404-1213-285213.php?Lang=zh-tw https://hdrc.ndhu.edu.tw/p/406-1185-245723,r11.php?Lang=zh-tw https://www.nics.nat.gov.tw/core_business/information_security_information_sharing/Vulnerability_Alert_Announcements/2178992e-6020-49ce-94f3-8edfd7993d35/ https://www.nchu.edu.tw/news-detail.php?id=60043 https://net.nthu.edu.tw/netsys/en:mailing:announcement:20250725_03?do=export_pdf https://cc.ncku.edu.tw/var/file/213/1213/img/4803/885636043.pdf https://www.cvedetails.com/cve/CVE-2025-7916/ https://nvd.nist.gov/vuln/detail/cve-2025-7916
Related VulnerabilitiesPoCCVE-2017-7504: JBossMQ HTTP Invocation Layer (HTTPServerILServlet) - Unauthenticated Java DeserializationPoCCVE-2015-7501: Red Hat JBoss - Insecure DeserializationPoCCVE-2019-1003030: Jenkins Pipeline Groovy Plugin <=2.63 - Insecure DeserializationPoCCVE-2025-26399: SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCEPoCCVE-2026-58644: Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE英華達|全家寶 Cloud - Insecure Direct Object ReferencePoCCVE-2024-42323: Apache HertzBeat < 1.6.0 - SnakeYAML Deserialization Remote Code ExecutionPoCCVE-2026-35273: Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCEPoCCVE-2026-46725: TYPO3 ceselector Extension - Insecure Deserialization沛盛資訊|OMICARD EDM - Insecure Direct Object Reference金財通商務科技|Service Center - Insecure Direct Object ReferencePoCCVE-2026-33439: OpenAM <= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserialization日躍科技|App好校通 - Insecure Direct Object Reference