References https://www.twcert.org.tw/tw/cp-132-5355-6e339-1.html https://www.cvedetails.com/cve/CVE-2021-43360/ https://www.cve.org/CVERecord?id=CVE-2021-43360 https://stack.watch/vuln/CVE-2021-43360/ https://www.twcert.org.tw/tw/lp-132-1-27-20.html
Related VulnerabilitiesPoCCVE-2017-7504: JBossMQ HTTP Invocation Layer (HTTPServerILServlet) - Unauthenticated Java DeserializationPoCCVE-2015-7501: Red Hat JBoss - Insecure DeserializationPoCCVE-2019-1003030: Jenkins Pipeline Groovy Plugin <=2.63 - Insecure DeserializationPoCCVE-2025-26399: SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCEPoCCVE-2026-58644: Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE英華達｜全家寶 Cloud - Insecure Direct Object ReferencePoCCVE-2024-42323: Apache HertzBeat < 1.6.0 - SnakeYAML Deserialization Remote Code ExecutionPoCCVE-2026-35273: Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCEPoCCVE-2026-46725: TYPO3 ceselector Extension - Insecure Deserialization沛盛資訊｜OMICARD EDM - Insecure Direct Object Reference金財通商務科技｜Service Center - Insecure Direct Object ReferencePoCCVE-2026-33439: OpenAM <= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserialization日躍科技｜App好校通 - Insecure Direct Object Reference