THREATOPS

THREAT OPS › Threat News › CVE-2026-66256: Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)

CVE-2026-66256: Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)

medoss_secPublished 2026-08-13

Posted by Arnout Engelen on Aug 13Severity: important Affected versions: - Apache Shindig Common (org.apache.shindig:shindig-common): all versions - Apache Shindig Social-Api (org.apache.shindig:shindig-social-api): all versions Description: ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Sh

Indicators of compromise

CVE-2026-66256cve

Original source: https://seclists.org/oss-sec/2026/q3/483

Same event, other sources

[NVD] CVE-2026-66256 (HIGH 7.2) — ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. nvd · 2026-08-13