Is CVE-2026-11860 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11860 being exploited in the wild.

How severe is CVE-2026-11860?

Informational severity, with a CVSS score of 7.5, published 15 June 2026.

Which products and versions are affected?

OpenSolution Quick.CMS All versions up to 6.8 (prior to 2026-05-14 patch).

Is there a fix for CVE-2026-11860?

A patch was published on 2026-05-14: Patch released for version 6.8 enforcing HTTPS Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-11860 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-11860?

Check whether you run OpenSolution Quick.CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11860: OpenSolution Quick.CMS insecure deserialization in admin panel

CVE-2026-11860 · Severity: info · CVSS 7.5 · Published 2026-06-15

OpenSolution Quick.CMS, a content management system used for building websites, contains a security flaw in how it handles data sent to the administrator panel. Because the system processes unencrypted information sent over the network without verifying its authenticity, an attacker on the same network can intercept and modify this data. This could allow an attacker to take complete control of the web server and execute unauthorized commands when an administrator logs in.

Technologies: OpenSolution Quick.CMS. Vendors: OpenSolution.

Quick answers

Is CVE-2026-11860 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11860 being exploited in the wild.
How severe is CVE-2026-11860?: Informational severity, with a CVSS score of 7.5, published 15 June 2026.
Which products and versions are affected?: OpenSolution Quick.CMS All versions up to 6.8 (prior to 2026-05-14 patch).
Is there a fix for CVE-2026-11860?: A patch was published on 2026-05-14: Patch released for version 6.8 enforcing HTTPS Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11860 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-11860?: Check whether you run OpenSolution Quick.CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Quick.CMS (up to version 6.8) is vulnerable to insecure deserialization (CWE-502) because it processes serialized data received via plaintext HTTP without integrity checks. An attacker positioned to perform a Man-in-the-Middle (MitM) attack can intercept the traffic and inject malicious PHP objects. Since the application lacks class whitelisting during deserialization, these objects can trigger magic methods like __wakeup() or __destruct() to initiate gadget chains. This leads to arbitrary code execution (RCE) on the server. The vulnerability is triggered automatically when an administrator accesses the management panel. A patch was released on May 14, 2026, which mitigates the issue by enforcing HTTPS communication.

Affected products

OpenSolution Quick.CMS All versions up to 6.8 (prior to 2026-05-14 patch)

Timeline

2026-05-14: patched: Patch released for version 6.8 enforcing HTTPS
2026-06-15: advisory: Advisory published by CERT.PL and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.