CVE-2026-45162 pimcore CVE debrief

Who should care

Organizations using Pimcore versions prior to 11.5.17 (LTS) or 12.3.7 should apply the patches immediately to prevent potential remote code execution attacks. Developers and administrators responsible for maintaining Pimcore installations are particularly concerned.

Technical summary

The vulnerability arises from insecure use of PHP's unserialize() function in multiple Pimcore components. Specifically, the following locations are affected: lib/Tool/Authentication.php, models/Site/Dao.php, models/DataObject/ClassDefinition/CustomLayout/Dao.php, models/Tool/TmpStore/Dao.php, models/Asset/WebDAV/Service.php, and admin-ui-classic-bundle/src/Helper/Dashboard.php. These locations unserialize data from database columns and filesystem files without properly restricting the classes that can be unserialized, allowing for object injection and remote code execution.

Defensive priority

High

Recommended defensive actions

• Apply patches: Upgrade to Pimcore version 11.5.17 (LTS) or 12.3.7.
• Inventory and monitoring: Check for and monitor usage of affected Pimcore components.
• Compensating controls: Implement additional security measures such as web application firewalls (WAFs) to detect and prevent exploitation attempts.
• Exception tracking: Monitor for unusual activity that may indicate attempted exploitation.
• Retest: Verify vulnerability remediation and test for potential bypasses.

Evidence notes

The CVE record was published on 2026-07-17T19:17:14.167Z and has not been modified since then. The NVD entry is currently 8.0 HIGH. Multiple source references are provided, including commits, pull requests, and security advisories related to the Pimcore patches.

Official resources