All vulnerabilities
CVE-2026-12613

Insecure Deserialization Leading to Remote Code Execution in Ministry of Justice's UYAP Document Editor

Ministry of Justice General Directorate of Information Technology UYAP Document Editor
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.4.20Also 5.4.21CVE List
Published12 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on MacOS allows Object Injection.

This issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.

Text from CVE List

Affected versions 2

  • UYAP Document Editoraffected: all versions before 5.4.20CVE List
  • UYAP Document Editoraffected: all versions before 5.4.21CVE List

References 1