CVE-2026-116230: Ndemic Creations Plague Inc Evolved Workshop Scenario Loader deserialization

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-10-26 · updated 2026-10-31
Weakness: CWE-20

Description

A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader. Such manipulation leads to deserialization. The attack may be performed from remote. Upgrading to version 1.24.0.4 is sufficient to fix this issue. It is recommended to upgrade the affected component.

Summary

A critical deserialization flaw (CVSS 9.8) exists in the Workshop Scenario Loader component of Ndemic Creations Plague Inc Evolved up to version 1.24.0.3, allowing remote attackers to manipulate data through crafted Workshop scenarios. A public exploit or detection template exists, though the flaw is not in CISA KEV and EPSS estimates a 0.3% chance of exploitation in 30 days. Upgrade to version 1.24.0.4 to remediate; no other mitigation is specified.

توجد ثغرة حرجة في إلغاء التسلسل (deserialization) بدرجة CVSS 9.8 في مكوّن Workshop Scenario Loader ضمن Ndemic Creations Plague Inc Evolved حتى الإصدار 1.24.0.3، وتتيح للمهاجمين عن بُعد التلاعب بالبيانات عبر سيناريوهات Workshop مُعدّة خصيصاً. يتوفر استغلال عام أو قالب كشف، رغم أن الثغرة ليست ضمن CISA KEV وتقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 0.3%. الحل هو الترقية إلى الإصدار 1.24.0.4، ولم يُذكر أي إجراء تخفيف بديل.

Affected products

Ndemiccreations Plague Inc Evolved: through 1.24.0.3
Ndemic Creations Plague Inc Evolved: 1.24.0.0, 1.24.0.1, 1.24.0.2, 1.24.0.3

References

Get alerted when CVE-2026-116230 or the next vulnerability affects your stack