CVE-2023-37286

9.8 criticalEPSS 1.0%

Critical (9.8) in smartsoft smartbpm.net. EPSS 1.0% chance of exploitation in the next 30 days.

SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code and disrupt service.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
CWE: CWE-798
Published: 2023-07-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

smartsoft:smartbpm.net

References

https://www.twcert.org.tw/tw/cp-132-7221-438c6-1.html
https://www.twcert.org.tw/tw/cp-132-7221-438c6-1.html

Check your stack JSON