# CVE-2026-11815: Symantec API Gateway insecure deserialization

Source: https://junglewise.ai/threats/cve-2026-11815-symantec-api-gateway-insecure-deserialization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-11815 · Severity: info · CVSS 5.3 · Published 2026-06-10

A security vulnerability exists in the Symantec API Gateway, a tool used to manage and secure communications between different software applications. An attacker who is able to intercept network traffic between a client and the gateway could manipulate data to run unauthorized commands. This could lead to a complete takeover of the gateway or unauthorized access to sensitive business data.

Technologies: [Symantec API Gateway](https://junglewise.ai/threats/technologies/api-gateway). Vendors: [Symantec](https://junglewise.ai/threats/vendors/symantec).

## Quick answers

**Is CVE-2026-11815 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11815 being exploited in the wild.

**How severe is CVE-2026-11815?** Informational severity, with a CVSS score of 5.3, published 10 June 2026.

**Which products and versions are affected?** Symantec API Gateway.

**Is there a fix for CVE-2026-11815?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11815 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-11815?** Check whether you run Symantec API Gateway. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Symantec API Gateway is vulnerable to the deserialization of untrusted data (CWE-502). The vulnerability occurs when the server processes manipulated traffic intercepted between a client application and the API Gateway. An attacker with low privileges and the ability to perform a man-in-the-middle (MitM) attack or otherwise intercept network traffic can inject malicious serialized objects. Successful exploitation can lead to broken security expectations or full remote code execution (RCE) on the gateway server. The attack complexity is considered high as it requires the attacker to be in a position to intercept and modify active traffic.

## Affected products

- Symantec API Gateway

## Timeline

- 2026-06-10: advisory: Initial advisory published by Symantec/Broadcom

## References

- [https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37631](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37631)