CVE-2018-15616: System Platform Web UI Deserialization

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-10-17 · updated 2026-06-17
Weakness: CWE-502

Description

A vulnerability in the Web UI component of Avaya Aura System Platform could allow a remote, unauthenticated user to perform a targeted deserialization attack that could result in remote code execution. Affected versions of System Platform includes 6.3.0 through 6.3.9 and 6.4.0 through 6.4.2.

Affected products

Avaya Aura® System Platform: from 6.3.0 through 6.3.9; from 6.4.0 through 6.4.2

References

https://downloads.avaya.com/css/P8/documents/101052865
https://downloads.avaya.com/css/P8/documents/101052865

Get alerted when CVE-2018-15616 or the next vulnerability affects your stack