CVE-2020-7961: Liferay Portal Deserialization of Untrusted Data Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 99.9% chance of exploitation in the next 30 days.

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).

Affected products

• Liferay Liferay Portal: before 7.2.1 (fixed in 7.2.1)

Published 2020-03-20. Last modified 2026-06-17.