CVE-2026-57527: Zaproxy Zap-Extensions

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter. The JSFViewState.decode() method base64-decodes the ViewState value and passes it directly to ObjectInputStream.readObject() without a deserialization filter, allowlist, or type restriction, causing the malicious object to be deserialized within the ZAP JVM when the Desktop UI renders the ViewState panel.

Affected products

• Zaproxy Zap-Extensions: before 4 (fixed in 4)

Published 2026-06-26. Last modified 2026-07-14.