CVE-2021-27335

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-02-18 · updated 2026-06-17
Weakness: CWE-502

Description

KollectApps before 4.8.16c is affected by insecure Java deserialization, leading to Remote Code Execution via a ysoserial.payloads.CommonsCollections parameter.

Affected products

Kollectapp Kollect: before 4.8.16c — fixed in 4.8.16c

How to fix

Upgrade to a fixed version: Kollectapp Kollect 4.8.16c. Check the vendor advisory for mitigations.

References

https://hacked0x90.net/index.php/2021/02/15/kollectapp-insecure-java-deserialization/
https://hacked0x90.net/index.php/2021/02/15/kollectapp-insecure-java-deserialization/

Get alerted when CVE-2021-27335 or the next vulnerability affects your stack