HGiga OAKlouds is at the center of a new critical advisory, as CVE-2026-93467 allows unauthenticated remote attackers to execute arbitrary code on the server. The advisory was published on September 18, 2026, and does not yet have a specific version limit for affected versions.
According to the CVE-2026-93467 entry on CVEFeed, the issue is classified as an unsafe deserialization vulnerability and concerns a product developed by HGiga. The same page displays a rating of 9.8 and a CRITICAL, while describing an unauthenticated attack.
See also: CVE-2026-61599 djust: WebSocket vulnerability allows module injection
HGiga OAKlouds and the risk of deserialization
Deserialization is the process by which an application converts data into objects that its code can use. When input is poorly controlled, an attacker can send specially crafted content and affect how the software creates or processes the objects.
In the case of HGiga OAKlouds, the available description states that the remote user does not need an account or victim interaction. All they need to do is send malicious serialized content to an accessible service for the vulnerability to lead to arbitrary code execution on the server.
The impact depends on the privileges of the process running the platform. If the server has access to databases, shared files, or credentials of other services, a successful attack can be a starting point for data theft, configuration changes, and lateral movement across the network.
What we know about CVE-2026-93467
The public filing does not list specific versions of HGiga OAKlouds , nor does it include a manufacturer's guidance with a patch number. CVEFeed notes that no product has been listed with a detailed range of affected versions, so administrators should not assume any version is safe without confirmation from HGiga.
The absence of a patch does not mean that the risk is theoretical. CVE-2026-93467 requires few prerequisites from the attacker, as it is described as remote and unauthenticated. This makes it critical to identify installations that are exposed to the Internet or untrusted internal networks.
HGiga has a history of vulnerabilities in the OAKlouds family. In an earlier TWCERT advisory for CVE-2024-9924, the service was described as vulnerable to file reading and deletion without a user login, fixed in versions 1162 and later. This is a different issue, but it illustrates why a full installation scan is required.
See also: Browserless: Playwright WebSocket vulnerability exposes files
Immediate actions for administrators
Until more information is released, system administrators should document all HGiga OAKlouds, their versions, and access points. The platform's management interface and services should be limited to strictly necessary networks, with firewall or VPN rules, but this is not considered a definitive solution.
At the same time, log files should be checked for unusual requests, deserialization failures, new files, unknown processes, and outbound connections from the server. Accounts and credentials available to the service should be rotated if there is evidence that the system was accessible to untrusted users.
The safest technical direction is to avoid deserializing untrusted data, implement strict input validation, and run the service with the least possible privileges. The same CVEFeed list also lists CVE-2026-93468 for reading files in OAKlouds, with no available versions or patch instructions, which reinforces the need for comprehensive control.
Security teams should compare the current snapshot with configuration copies and previous logs. Looking for unusual request parameters, sudden user changes, and processes started by the service can reveal exploitation attempts, even when there is no public attack tool available.
Network segmentation also limits the impact of a potential breach. The platform should not have access to more systems than it needs to operate, and backups and secrets should remain outside the immediate reach of the server.
See also: Issabel Framework: CVE-2026-89026 exposes PBX via shared JWT key
The SecNews technical team recommends that installations remain out of public exposure until an official update from HGiga or a documented fix is available. Monitoring logs, isolating the service, and promptly installing any available patch are key measures to mitigate the risk from CVE-2026-93467.
