Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter. The JSFViewState.decode() method base64-decodes the ViewState value and passes it directly to ObjectInputStream.readObject() without a deserialization filter, allowlist, or type restriction, causing the malicious object to be deserialized within the ZAP JVM when the Desktop UI renders the ViewState panel.
{
"cna_assigner": "VulnCheck",
"cwe_ids": [
"CWE-502"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57527.json"
}{
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"original_tag": "viewstate-v4",
"range": [
{
"fixed": "ac6c3f94d38505bc0facea286a4d3728044c6e5c"
}
],
"source": "REFERENCES_TAG"
},
{
"range": [
{
"fixed": "ac6c3f94d38505bc0facea286a4d3728044c6e5c"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"introduced": "0"
},
{
"fixed": "4"
}
],
"source": "DESCRIPTION"
}
]
}