CVE-2018-20221

8.8 highEPSS 10%

High (8.8) in deltek ajera. EPSS 10% chance of exploitation in the next 30 days.

Secure/SAService.rem in Deltek Ajera Timesheets 9.10.16 and prior are vulnerable to remote code execution via deserialization of untrusted user input from an authenticated user. The executed code will run as the IIS Application Pool that is running the application.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 10% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
CWE: CWE-502
Published: 2019-03-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

deltek:ajera

References

http://packetstormsecurity.com/files/151035/Ajera-Timesheets-9.10.16-Deserialization.html
https://www.exploit-db.com/exploits/46086/
http://packetstormsecurity.com/files/151035/Ajera-Timesheets-9.10.16-Deserialization.html
https://www.exploit-db.com/exploits/46086/

Check your stack JSON