CVE-2026-38950

CVSS 7.8 HIGHEPSS 0.1%CWE-502

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 7.8EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

01 jun 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files. The affected components load model files from session directories using torch.load() with unrestricted deserialization.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Productos afectados

n/a · n/a

Referencias

https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md https://github.com/esa/AnomalyMatch/pull/9 https://imlabs.info/research/security_advisory_esa_anomaly_match_unsafe_deserialization_cve_2026_38950_ivan_markovic_052026.html