CVE-2026-27776

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

IM-LogicDesigner module of intra-mart Accel Platform contains insecure deserialization issue. This can be exploited only when IM-LogicDesigner is deployed on the system. Arbitrary code may be executed when some crafted file is imported by a user with the administrative privilege.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
NTT DATA INTRAMART Corporation	intra-mart Accel Platform	2017 Spring (8.0.4) through 2025 Autumn (8.0.27)

References

https://global.intra-mart.support/hc/en-us/articles/55266898383641Vendor Advisory
https://jvn.jp/en/jp/JVN80500630/Third Party Advisory

Timeline

Published: Feb 27, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-277776.5Charging station authentication identifiers are publicly accessible via web-based mapping platforms.CVE-2026-277787.5The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting m CVE-2026-277797.5Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL CVE-2026-277810.0Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox CVE-2026-277809.8Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to CVE-2026-277813.3in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.CVE-2026-277834.3Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints.CVE-2026-277847.8The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-CVE-2026-277858.8Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials.CVE-2026-277875.1Cross-site scripting vulnerability exists in MATCHA SNS 1.3.9 and earlier. If this vulnerability is exploited, an arbitrary script may be ex CVE-2026-277888.5Incorrect permission assignment for critical resource issue exists in ServerView Agents for Windows V11.60.04 and earlier. If this vulnerabi CVE-2026-27799.8Incorrect boundary conditions in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird