Junglewise Threat Intelligence

CVE-2026-57527: ZAP ViewState add-on insecure deserialization in JSFViewState.decode

CVE-2026-57527 · Severity: high · CVSS 8.8 · Published 2026-06-26

Executive brief

The Zed Attack Proxy (ZAP) ViewState add-on, a tool used by security professionals to analyze web traffic, contains a vulnerability that could allow a malicious website to execute code on a user's computer. If a user uses ZAP to inspect a specially crafted response from a malicious server, the software may inadvertently run unauthorized commands. This could lead to a full system compromise or data theft from the machine running the ZAP Desktop UI.

Technical details

An insecure deserialization vulnerability exists in the JSFViewState.decode() method of the ZAP ViewState add-on. The component base64-decodes the 'javax.faces.ViewState' HTTP response parameter and passes it directly to ObjectInputStream.readObject() without implementing a deserialization filter or allowlist. An attacker controlling a proxied web server can trigger this by sending a malicious serialized Java object, which is executed within the ZAP JVM when the user views the ViewState panel in the Desktop UI. While the ZAP team noted that classloader isolation and updated dependencies may hinder RCE in some environments, the vulnerability is confirmed to allow at least DNS interaction and potentially full code execution. The issue is resolved in ViewState version 4 by disabling JSF support.

Affected products

  • ZAP (Zed Attack Proxy) ViewState add-on before version 4

Timeline

  • 2026-06-24: patched: Version 4 of the add-on released
  • 2026-06-24: advisory: ZAP team published a blog post regarding the vulnerability
  • 2026-06-26: disclosed: CVE-2026-57527 published to NVD

References