CVE-2023-49886
Published: 06 October 2025
Summary
CVE-2023-49886 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Ibm Transformation Extender Advanced. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2023-49886 is an unsafe Java deserialization vulnerability (CWE-502) affecting IBM Standards Processing Engine version 10.0.1.10. Published on 2025-10-06, it enables a remote attacker to execute arbitrary code on the system by sending specially crafted input that triggers the deserialization flaw.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is highly severe and exploitable over the network with low complexity, no privileges, and no user interaction required. Any unauthenticated remote attacker can target exposed instances of the affected software to achieve full remote code execution, potentially compromising confidentiality, integrity, and availability.
Mitigation details are provided in the IBM security advisory at https://www.ibm.com/support/pages/node/7247179.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-53786
Vulnerability details
IBM Standards Processing Engine 10.0.1.10 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe java deserialization. By sending specially crafted input, an attacker could exploit this vulnerability to execute arbitrary code on the…
more
system.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2023-49886 is an unauthenticated remote code execution vulnerability in a public-facing application via unsafe Java deserialization, directly enabling T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring timely remediation and patching of the unsafe Java deserialization flaw.
Prevents exploitation by validating and sanitizing specially crafted inputs that trigger the deserialization vulnerability.
Limits remote unauthenticated access to the vulnerable endpoint by monitoring and controlling communications at system boundaries.