Is CVE-2026-97865 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97865 being exploited in the wild.

How severe is CVE-2026-97865?

High severity, with a CVSS score of 7.3, published 25 September 2026.

Which products and versions are affected?

Open-Web-Analytics up to 1.8.1.

Is there a fix for CVE-2026-97865?

A patch was published on 2026-07-31: Version 1.8.2 addresses the issue; patch 78c1222ec0e2119d84684032da1541120a2cdd23 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-97865 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-97865?

Check whether you run Open-Web-Analytics at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97865: Open-Web-Analytics unsafe deserialization in Remote Event Queue

CVE-2026-97865 · Severity: high · CVSS 7.3 · Published 2026-09-25

Open-Web-Analytics is a web analytics platform that collects usage data from websites. A vulnerability in its Remote Event Queue endpoint allows unauthenticated attackers to manipulate event data and queue bookkeeping fields through unsanitized input. While not remote code execution, this could lead to queue state corruption and potential privilege escalation if the endpoint is enabled.

Technologies: Open-Web-Analytics. Vendors: Open-Web-Analytics.

Quick answers

Is CVE-2026-97865 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97865 being exploited in the wild.
How severe is CVE-2026-97865?: High severity, with a CVSS score of 7.3, published 25 September 2026.
Which products and versions are affected?: Open-Web-Analytics up to 1.8.1.
Is there a fix for CVE-2026-97865?: A patch was published on 2026-07-31: Version 1.8.2 addresses the issue; patch 78c1222ec0e2119d84684032da1541120a2cdd23 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97865 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-97865?: Check whether you run Open-Web-Analytics at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Event::loadFromArray function in queue.php accepts and deserializes untrusted input from HTTP requests without validation, copying arbitrary properties into queue objects. This allows remote unauthenticated attackers to modify internal queue state and event properties intended to be set only by the local system. The vulnerability requires the remote event queue endpoint to be explicitly enabled (it ships disabled by default).

Affected products

Open-Web-Analytics Open-Web-Analytics up to 1.8.1

Timeline

2026-09-25: disclosed
2026-07-31: patched: Version 1.8.2 addresses the issue; patch 78c1222ec0e2119d84684032da1541120a2cdd23

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.