CVE-2026-27333: Unauthenticated RCE in Paid Videochat Turnkey Site

Technical summary

CVE-2026-27333 is an unauthenticated deserialization vulnerability (CWE-502) affecting Paid Videochat Turnkey Site through version 7.3.23. The application deserializes untrusted input without sufficient integrity checks, enabling remote code execution. The CVSS 3.1 score of 8.1 (HIGH severity) reflects high impact across confidentiality, integrity, and availability. The attack requires network access but does not depend on user interaction or elevated privileges, making it practically exploitable despite a high attack complexity factor.

Business impact

Compromise of a videochat platform through unauthenticated RCE carries significant operational and reputational risk. Attackers could harvest user data, inject malicious content into video streams, hijack the platform for botnet or malware distribution, or disrupt service availability. For SaaS operators or enterprises hosting this software, the lack of authentication requirement means the attack surface encompasses any internet-facing instance. Downstream users may face privacy violations and loss of trust.

Affected systems

Paid Videochat Turnkey Site versions 7.3.23 and earlier are vulnerable. Organizations should identify all instances of this software in their environment—both production and staging—and verify the exact version. No patch version information has been provided in the vulnerability record; you must consult the vendor advisory to confirm remediation guidance and available patches.

Exploitability

This is an unauthenticated, network-accessible vulnerability requiring only knowledge of the attack vector. No CVE appears on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the advisory date, but the structural risk profile—unauthenticated RCE via deserialization—is well-established in attacker toolkits. Attack complexity is rated high, suggesting some technical prerequisites or environmental conditions may affect exploitability, but the barrier remains significantly lower than a vulnerability requiring authentication or user interaction.

Remediation

Immediate action is required. First, verify your installed version against the vendor's official advisory. If running version 7.3.23 or earlier, prioritize patching to the vendor's recommended fixed release. Pending patch deployment, implement compensating controls: restrict network access to the application using firewall rules, disable the application if not in active use, and monitor for suspicious deserialization activity. Validate the patch has been applied and test in a non-production environment before broad rollout.

Patch guidance

Contact the vendor for the current patch release and detailed upgrade instructions. Verify patch applicability to your specific deployment architecture. Test the patch in a staging environment to confirm compatibility with any custom configurations or dependent services. Plan a maintenance window for deployment, and confirm successful patching by checking the version string and validating normal application functionality post-upgrade.

Detection guidance

Monitor network traffic for unusual POST or PUT requests to the application with serialized Java objects or PHP serialization payloads (signatures like 'O:' or 'x90x00x00x00'). Log and alert on deserialization errors or exceptions in application error logs. Consider deploying a Web Application Firewall (WAF) configured to block suspicious serialized data patterns. Hunt in endpoint logs for unexpected child processes spawned by the application service user, which may indicate successful code execution. Review application access logs for unauthenticated requests from unexpected sources.

Why prioritize this

This vulnerability merits immediate prioritization due to its HIGH CVSS score, unauthenticated attack surface, and direct path to remote code execution. The lack of authentication requirement and network accessibility mean an attacker can exploit this without compromise of user credentials. Organizations should treat this as critical infrastructure risk and allocate resources accordingly.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects the combination of network-accessible attack vector (AV:N), no privilege or user interaction requirement (PR:N/UI:N), and complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). The HIGH attack complexity (AC:H) prevents a critical rating; however, the fundamental exposure remains severe enough to warrant urgent remediation.

Frequently asked questions