Quick answers
- Is CVE-2026-113404 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-113404 being exploited in the wild.
- How severe is CVE-2026-113404?
- High severity, with a CVSS score of 8.8, published 20 October 2026.
- Which products and versions are affected?
- Uniong Webitr 2_1_0_34 and earlier.
- Is there a fix for CVE-2026-113404?
- Yes: fixed in WebITR 2_1_0_36 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-113404 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-113404?
- Check whether you run Uniong Webitr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: WebITR 2_1_0_36 or later
Technical details
WebITR contains an insecure deserialization vulnerability in its cryptographic key handling. Authenticated remote attackers can craft malicious serialized data using the hardcoded cryptographic key and submit it to achieve remote code execution on the server. The vulnerability requires authentication but allows arbitrary code execution once the attacker has valid credentials.
Affected products
- Uniong WebITR 2_1_0_34 and earlier
Timeline
- 2026-10-20: disclosed