Executive brief
Yonyou U8 Cloud is a cloud-based enterprise resource planning (ERP) system used for financial and business management. An unauthenticated remote code execution vulnerability in the file management component allows attackers to execute arbitrary commands on the server without any credentials, potentially leading to full system compromise, data theft, and operational disruption.
Technical details
The vulnerability is a Java deserialization flaw in the FileManageServlet component (doAction method) that accepts serialized Java objects via POST requests without authentication or validation. The vulnerable code passes raw HTTP request body data directly to ObjectInputStream.readObject(), allowing attackers to deserialize malicious payloads containing arbitrary OS commands. The attack requires only network access to the web service; no authentication credentials are needed. Successful exploitation results in remote code execution with the privileges of the application server process. Patch availability status is not mentioned in the advisory.
Affected products
- Yonyou U8 Cloud <unknown>
Timeline
- 2026-09-15: disclosed
- 2025-02-13: exploited: Exploitation observed by Shadowserver Foundation