CVE-2025-10363: Unauthenticated RCE via .NET Deserialization in Topal Finance Software

Severity: critical (CVSS 10.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-06 · updated 2026-10-18
Weakness: CWE-502

Description

Deserialization of Untrusted Data vulnerability in Topal Solutions AG Topal Finanzbuchhaltung on Windows allows Remote Code Execution.This issue affects at least Topal Finanzbuchhaltung: 10.1.5.20 and is fixed in version 11.2.12.00

Affected products

Topal Solutions AG Topal Finanzbuchhaltung: 10.1.5.20

References

https://info.topal.ch/content/info/Topal_ReleaseNotes/de/version_v11_2_12_0.htm
https://labs.infoguard.ch/advisories/cve-2025-10363_topal_deserialization_unauth_rce/

Get alerted when CVE-2025-10363 or the next vulnerability affects your stack