CVE-2021-3160: Aca Assuweb

Critical severity, CVSS 9.8. EPSS: 4.7% chance of exploitation in the next 30 days.

Deserialization of untrusted data in the login page of ASSUWEB 359.3 build 1 subcomponent of ACA ASSUREX RENTES product allows a remote attacker to inject unsecure serialized Java object using a specially crafted HTTP request, resulting in an unauthenticated remote code execution on the server.

Affected products

• Aca Assuweb: version 359.3 only

Published 2021-01-28. Last modified 2026-06-17.