CVE-2026-42472
Published: 01 May 2026
Summary
CVE-2026-42472 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-42472 is an unsafe deserialization vulnerability in the MixPHP Framework versions 2.x through 2.2.17. The issue affects the session and cache handlers, which invoke the unserialize() function on data retrieved from Redis via the RedisHandler object. This flaw, cataloged as CWE-502, carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-05-01.
Attackers with network access can exploit this vulnerability without authentication, privileges, or user interaction, as it requires low attack complexity. Exploitation involves crafting malicious serialized data that can be stored in Redis and subsequently deserialized, enabling high-impact compromise of confidentiality, integrity, and availability on the targeted system.
Mitigation guidance and patches are referenced in advisories at https://gist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975, the MixPHP GitHub repository https://github.com/mix-php/mix, and the affected source file at https://github.com/mix-php/mix/blob/v2.2.17/src/sync-invoke/src/Server.php. Security practitioners should review these for upgrade instructions beyond version 2.2.17.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26673
Vulnerability details
Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from Redis in the RedisHandler object.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unsafe deserialization (CWE-502) in public-facing PHP web framework enables remote unauthenticated RCE via malicious Redis data, mapping to exploitation of public-facing apps and command/script interpreter execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the unsafe deserialization vulnerability by identifying, patching, or upgrading the affected MixPHP Framework versions beyond 2.2.17.
Requires validation of data retrieved from Redis prior to unserialization to block malicious serialized payloads crafted by attackers.
Implements memory protections such as ASLR and non-executable memory to mitigate arbitrary code execution from successful deserialization exploits.