CVE-2026-11815

An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could potentially deserialize arbitrary objects. This vulnerability could lead to broken security expectations or remote code execution.

CVSS

No CVSS.

References

Link	Resource
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37631

Configurations

No configuration.

History

23 Jul 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) Un atacante que intercepta y manipula el tráfico entre la aplicación cliente y el servidor API Gateway podría potencialmente deserializar objetos arbitrarios. Esta vulnerabilidad podría conducir a expectativas de seguridad rotas o a ejecución remota de código.

10 Jun 2026, 07:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-10 07:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-11815

Mitre link : CVE-2026-11815

CVE.ORG link : CVE-2026-11815

JSON object : View

Products Affected

No product.

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-11815", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11815", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T14:42:32.420972Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "secure@symantec.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "secure@symantec.com", "affectedData": [{"vendor": "Broadcom", "modules": ["Policy Manager"], "product": "Layer 7 API Gateway", "versions": [{"status": "affected", "version": "11.2.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-10T07:16:24.713", "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37631", "source": "secure@symantec.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secure@symantec.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could potentially deserialize arbitrary objects. This vulnerability could lead to broken security expectations or remote code execution."}, {"lang": "es", "value": "Un atacante que intercepta y manipula el tr\u00e1fico entre la aplicaci\u00f3n cliente y el servidor API Gateway podr\u00eda potencialmente deserializar objetos arbitrarios. Esta vulnerabilidad podr\u00eda conducir a expectativas de seguridad rotas o a ejecuci\u00f3n remota de c\u00f3digo."}], "lastModified": "2026-07-23T09:10:00.113", "sourceIdentifier": "secure@symantec.com"}