CVE-2026-25873
Published: 18 March 2026
Summary
CVE-2026-25873 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Arxiv (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 IA-8 (Identification and Authentication (Non-organizational Users)) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-25873 is an unauthenticated remote code execution vulnerability in the reward server component of OmniGen2-RL. The flaw arises from insecure pickle deserialization of HTTP POST request bodies, enabling remote attackers to execute arbitrary commands on the host system running the exposed service. Published on 2026-03-18, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-502 (Deserialization of Untrusted Data).
Remote attackers can exploit this vulnerability without authentication, privileges, or user interaction by sending crafted malicious HTTP POST requests to the reward server. Exploitation leads to arbitrary code execution on the host, with high impacts on confidentiality, integrity, and availability, potentially allowing full system compromise.
References point to an arXiv paper (https://arxiv.org/abs/2506.18871), a detailed blog post on the OmniGen2 pickle RCE (https://chocapikk.com/posts/2026/omnigen2-pickle-rce/), and specific GitHub code locations in the OmniGen2-RL repository, including reward_proxy.py lines 208 and 224, and reward_server.py line 118, which highlight the vulnerable deserialization logic. No vendor patches or formal mitigation advisories are detailed in the provided references.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12954
Vulnerability details
OmniGen2-RL contains an unauthenticated remote code execution vulnerability in the reward server component that allows remote attackers to execute arbitrary commands by sending malicious HTTP POST requests. Attackers can exploit insecure pickle deserialization of request bodies to achieve code execution…
more
on the host system running the exposed service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-25873 enables unauthenticated remote code execution by exploiting insecure pickle deserialization in a public-facing HTTP reward server, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the insecure pickle deserialization vulnerability by requiring validation of untrusted HTTP POST request bodies to block malicious payloads.
Ensures timely remediation of the specific deserialization flaw in the reward server component, eliminating the RCE vulnerability.
Requires identification and authentication for non-organizational users, preventing unauthenticated remote attackers from sending exploitable POST requests to the reward server.