CVE-2026-34838

🗓️ 02 Apr 2026 19:15:40Reported by GitHub_MType

Authenticated RCE in Group-Office via insecure deserialization in AbstractSettingsCollection.

Reporter	Title	Published	Views	Family All 11
attackerkb	CVE-2026-34838	2 Apr 202619:15	–	attackerkb
Circl	CVE-2026-34838	2 Apr 202620:56	–	circl
CNNVD	Group Office 代码问题漏洞	2 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-34838 Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`	2 Apr 202619:15	–	cvelist
EUVD	EUVD-2026-18532	2 Apr 202619:15	–	euvd
Kitploit	CVE-2026-34838	1 Oct 202617:21	–	kitploit
NVD	CVE-2026-34838	2 Apr 202620:16	–	nvd
Positive Technologies	PT-2026-29881	2 Apr 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-34838: Deserialization of Untrusted Data	2 Apr 202600:00	–	rapid7
RedhatCVE	CVE-2026-34838	3 Apr 202623:01	–	redhatcve

NVD

Vulners

Node

intermesh group-officeRange<6.8.156

intermesh group-officeRange25.0.1–25.0.90

intermesh group-officeRange26.0.1–26.0.12

[
  {
    "vendor": "Intermesh",
    "product": "groupoffice",
    "versions": [
      {
        "version": "< 6.8.156",
        "status": "affected"
      },
      {
        "version": "< 25.0.90",
        "status": "affected"
      },
      {
        "version": "< 26.0.12",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/Intermesh/groupoffice/releases/tag/v25.0.90
github	www.github.com/Intermesh/groupoffice/releases/tag/v6.8.156
github	www.github.com/Intermesh/groupoffice/security/advisories/GHSA-h22j-frrf-5vxq
github	www.github.com/Intermesh/groupoffice/releases/tag/v26.0.12

24 Jul 2026 21:10Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.19.9

EPSS0.00994

SSVC

CWE-502