CVE-2022-36944

criticalpriority · attend · 53EPSS 0.110 · 96 %ileexploit · PoCDEEUNLRUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

11.0% (96th) EPSS

CVSS 9.8 · critical

Is it mine?

147 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.19.3criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-502USprimaryCWE-502USCWE-502USCWE-502US

exploits (1)

Public proof-of-concept and weaponised exploit code.

yarocher/lazylist-cve-pocPOC for the CVE-2022-36944 vulnerability exploitPoC · poc_in_github

affected products (147)

Products and version ranges known to be affected.

Oracle Communications 12.6.0.0all versionscert_bundDEcpe:/a:oracle:communications:12.6.0.0
Oracle Communications 23.1.0.0all versionscert_bundDEcpe:/a:oracle:communications:23.1.0.0
Oracle Communications 23.1.3all versionscert_bundDEcpe:/a:oracle:communications:23.1.3
Oracle Communications 23.2.1all versionscert_bundDEcpe:/a:oracle:communications:23.2.1
Oracle Communications 23.3.0all versionscert_bundDEcpe:/a:oracle:communications:23.3.0
Oracle Communications 3.3all versionscert_bundDEcpe:/a:oracle:communications:3.3
Oracle Communications 4.0all versionscert_bundDEcpe:/a:oracle:communications:4.0
Oracle Communications 4.1all versionscert_bundDEcpe:/a:oracle:communications:4.1
Oracle Communications 7.2.0.0.0all versionscert_bundDEcpe:/a:oracle:communications:7.2.0.0.0
Oracle Communications 7.2.1.0.0all versionscert_bundDEcpe:/a:oracle:communications:7.2.1.0.0
Oracle Communications 9.0.0.0all versionscert_bundDEcpe:/a:oracle:communications:9.0.0.0
Oracle Communications 9.1.1.6.0all versionscert_bundDEcpe:/a:oracle:communications:9.1.1.6.0
Oracle Communications <= 23.1.7all versionscert_bundDEcpe:/a:oracle:communications:23.1.7
Oracle Communications <= 23.1.8all versionscert_bundDEcpe:/a:oracle:communications:23.1.8
Oracle Communications <= 23.2.2all versionscert_bundDEcpe:/a:oracle:communications:23.2.2
Oracle Communications <= 23.2.4all versionscert_bundDEcpe:/a:oracle:communications:23.2.4
Oracle Communications <= 9.0.2all versionscert_bundDEcpe:/a:oracle:communications:9.0.2
Oracle Communications <= 9.2all versionscert_bundDEcpe:/a:oracle:communications:9.2
Oracle Communications Applications 10.0.1.7.0all versionscert_bundDEcpe:/a:oracle:communications_applications:10.0.1.7.0
Oracle Communications Applications 15.0.0.0.0all versionscert_bundDEcpe:/a:oracle:communications_applications:15.0.0.0.0

showing 20 of 147

advisories (8)

Vendor and ecosystem advisories describing this.

NCSC-2024-0297 Kwetsbaarheden verholpen in Oracle Financial Services ApplicationsNL2024-07-17csaf · ncsc_nlNL
Er zijn kwetsbaarheden verholpen in Oracle Financial Services Applications.
WID-SEC-W-2022-2345Camunda: Schwachstelle ermöglicht PrivilegieneskalationDeutsch2022-12-15csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Camunda ausnutzen, um seine Privilegien zu erhöhen und Sicherheitsmaßnahmen zu umgehen.
WID-SEC-W-2023-1812Oracle Communications: Mehrere SchwachstellenDeutsch2023-07-18csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2023-2679Oracle Communications: Mehrere SchwachstellenDeutsch2023-10-17csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2024-0107Oracle Communications Applications: Mehrere SchwachstellenDeutsch2024-01-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2024-0124Oracle Financial Services Applications: Mehrere SchwachstellenDeutsch2024-01-16csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Financial Services Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2024-1638Oracle Financial Services Applications: Mehrere SchwachstellenDeutsch2024-07-16csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Financial Services Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
GHSA-8qv5-68g4-248jScala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization2022-09-25ghsa · osvUS
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with LazyList object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund ncsc_nl osv NVD CVE.org MITRE

published 2022-09-23modified 2026-06-17

related (3,744)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-63077US	—OT critical	93.6% (100th)	KEV	2026-07-27
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
CVE-2026-58644US	—OT critical	15.9% (97th)	KEV	2026-07-14
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVE-2026-50522US	—OT critical	3.04% (87th)	KEV	2026-07-14
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVE-2026-12569US	critical9.8OT critical	46.0% (99th)	KEV	2026-06-18
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of u…
CVE-2026-45247US	—OT critical	26.2% (98th)	KEV	2026-05-26
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code exec…

+3739 more

references (23)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan