Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet

published 2026-09-15 55 d ago modified 2026-09-24 45 d ago also EUVD-2023-60691

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits: 0; none known

Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.

Patch / fix

links 1

security.yonyou.com/#/noticeInfo?id=400 advisory

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: total
Assessed: 54 d ago (2026-09-15)

Exploit prediction

1.20% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

cn-sec.com https://cn-sec.com/archives/2182384.html referenced PoC, tagged "exploit" by a source, unverified
blog.csdn.net https://blog.csdn.net/qq_41904294/article/details/134277353 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	4.0	9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Yonyou U8 Cloud

Classification

Weakness

CWE-502 Deserialization of Untrusted Data

References

security.yonyou.com /#/noticeInfo?id=400
vendor-advisory, patch
cn-sec.com /archives/2182384.html
technical-description, exploit
blog.csdn.net /qq_41904294/article/details/134277353
technical-description, exploit
avd.aliyun.com /detail?id=AVD-2023-1686894
third-party-advisory
yonyou.com /Global/
product
vulncheck.com /advisories/yonyou-u8-cloud-java-deserialization-rce-via-filemanageservlet
third-party-advisory

Sources

CVE List CVE-2023-54398
NVD CVE-2023-54398

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary