TWCERT/CC announced two OAKlouds vulnerabilities: CVE-2026-93467 (insecure deserialization) and CVE-2026-93468 (arbitrary file read), both affecting
TVN-202609008 was announced on 2026-09-18, stating that OAKlouds has 2 vulnerabilities corresponding to CVE-2026-93467 and CVE-2026-93468. The announcement shows that both weaknesses can be exploited by unauthenticated remote attackers, and the affected products span the OAKlouds-custom_page and OAKlouds-bulletin_v3 product lines.
The risk of this type of announcement lies not only in the individual vulnerability itself, but also in the fact that it can be triggered directly remotely and can be attempted without an account. For systems that already provide services externally, if version patches are not completed in time, attackers may first target OAKlouds services exposed to the Internet.
CVE-2026-93467 is classified as Insecure Deserialization. The announcement explicitly states that an unauthenticated remote attacker can execute arbitrary code on the server by sending malicious serialized content. Its CVSS 4.0 score is 9.3 (Critical), and its CVSS 3.1 score is 9.8 (Critical), reflecting the extremely high exploitation value of this weakness.
From an attack surface perspective, the core risk of Insecure Deserialization is that if a system directly trusts external input and restores it into objects, an attacker may interfere with program flow through carefully crafted serialized data. Although the announcement does not disclose a more detailed exploitation chain, it is sufficient to determine that such vulnerabilities usually do not require complex prerequisites; once the attack packet reaches the target endpoint, it may be converted into server-side code execution.
CVE-2026-93468 is classified as Arbitrary File Read. The announcement states that an unauthenticated remote attacker can use Relative Path Traversal to read arbitrary system files. Its CVSS 4.0 score is 8.7 (High), and its CVSS 3.1 score is 7.5 (High).
The essence of Relative Path Traversal is that an attacker bypasses the intended directory restrictions through path concatenation or filename handling flaws, thereby accessing files that should not be readable. Although the announcement does not list specific readable file names, in practice, file reading can often be used to collect configuration files, keys, connection information, or other sensitive data, and then be combined with other vulnerabilities to expand the impact.
Notably, the two vulnerabilities have complementary risk patterns: the former leans toward direct server control, while the latter leans toward information disclosure and environment reconnaissance. If the same system exposes both types of flaws at once, an attacker can first use file reading to collect configuration and path information, and then further attempt higher-risk intrusion actions through the deserialization vulnerability.
CVE-2026-93467 affects OAKlouds-custom_page versions earlier than 2.0 26, OAKlouds-custom_page versions earlier than 3.0 26, and OAKlouds-custom_page versions earlier than 4.0 26. The patch conditions listed in the announcement indicate that any version lower than 26 is within the affected scope.
CVE-2026-93468 affects OAKlouds-bulletin_v3 versions earlier than 2.0 107, and OAKlouds-bulletin_v3 versions earlier than 3.0 107. The patch conditions listed in the announcement indicate that any version below 107 is within the affected scope.
From an administrative perspective, this means that if an organization uses different OAKlouds modules at the same time, patching cannot focus on only one product line; it must separately inventory the actual deployment versions of custom_page and bulletin_v3. If asset inventory is incomplete, it is easy for some nodes to be patched while others remain exposed, creating a gap in protection.
The first measure is to immediately upgrade to the patched versions according to the announcement. For CVE-2026-93467, OAKlouds-custom_page-2.0, 3.0, and 4.0 should be updated to versions 26 and later; for CVE-2026-93468, OAKlouds-bulletin_v3-2.0 and 3.0 should be updated to versions 107 and later.
Before the upgrade is completed, the exposure surface should be reduced first to avoid directly opening the relevant services to the public, and priority should be given to restricting allowable connection sources. If the system must remain online, it is recommended to review application logs, web access records, and abnormal request patterns in parallel, especially requests that appear to contain serialized content or path traversal strings.
In addition, for file access and deserialization-related code, security design checks should be implemented to confirm that external input is not directly restored into executable objects, and that all file paths undergo strict normalization and directory boundary validation. If the system contains highly sensitive configuration files, the principle of least privilege should also be reviewed to reduce the cascading impact after a single file leak.
Finally, it is recommended to incorporate this incident into the vulnerability management process, and establish mechanisms for version comparison, patch verification, and regression testing to avoid merely completing package updates without confirming that services operate normally. For externally accessible application systems, regular inventory and rapid patching remain key measures for reducing the spread of high-risk CVEs.