CVE-2026-1323
Published: 17 March 2026
Summary
CVE-2026-1323 is a medium-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Cps-It Mailqueue. Its CVSS base score is 5.2 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-1323 is a deserialization vulnerability (CWE-502) in a TYPO3 extension, where the component fails to properly define allowed classes during deserialization of transport failure metadata. This flaw affects TYPO3 CMS installations using the vulnerable extension and has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity with potential for high confidentiality, integrity, and availability impacts. The issue was published on 2026-03-17.
An attacker with low privileges (PR:L), such as an authenticated user, can exploit this vulnerability remotely over the network (AV:N) if they have write access to the directory specified by $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath']. By crafting malicious serialized data and placing it in this spool directory, the attacker can trigger deserialization of untrusted code during mail transport failure handling, leading to arbitrary code execution on the server.
For mitigation details, refer to the official TYPO3 security advisory at https://typo3.org/security/advisory/typo3-ext-sa-2026-005, which likely includes patch information and workarounds for affected installations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12548
Vulnerability details
The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Deserialization vulnerability in TYPO3 CMS extension enables remote exploitation of a public-facing web application for arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the deserialization vulnerability by applying vendor patches to properly define allowed classes in the TYPO3 extension.
Enforces least privilege to prevent low-privilege authenticated users from writing malicious serialized data to the mail transport spool directory.
Mitigates arbitrary code execution from unsafe deserialization through memory protections like non-executable memory and address space randomization.