CVE-2026-57527

Name of the Vulnerable Software and Affected Versions Zed Attack Proxy (ZAP) ViewState add-on versions prior to 4

Description An insecure deserialization issue exists where attackers controlling a proxied web server can achieve arbitrary code execution. This occurs by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter. The JSFViewState.decode() function base64-decodes the value and passes it to ObjectInputStream.readObject() without a deserialization filter, allowlist, or type restriction, leading to the deserialization of the malicious object within the ZAP JVM when the Desktop UI renders the ViewState panel.

Recommendations Update Zed Attack Proxy (ZAP) ViewState add-on to version 4 or later.