CVE-2026-36501: Controller 12.0.5 Denial of Service via Unsafe Deserialization

Technical summary

CVE-2026-36501 is a denial-of-service vulnerability in the Externalizable.readExternal() method of Controller v12.0.5. The flaw stems from improper input validation (CWE-20) during deserialization of externalized Java objects. An unauthenticated, remote attacker can exploit this by sending a malicious serialized payload that causes the application to exhaust resources or crash. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects that the attack is network-accessible with low complexity, requires no privileges or user interaction, and impacts availability only.

Business impact

Service unavailability resulting from a DoS attack can disrupt business operations that depend on Controller. Affected organizations may experience downtime affecting workflows, customer-facing services, or internal processes. Recovery requires either restarting the affected component or deploying a patched version. The impact is limited to availability; confidentiality and integrity are not compromised.

Affected systems

Controller version 12.0.5 is confirmed vulnerable. Organizations running this version in network-accessible configurations should prioritize assessment and patching. The vulnerability applies only to the specific version indicated; verify your deployment version against your asset inventory.

Exploitability

Exploitation is straightforward from a technical perspective: an attacker needs only network connectivity to the vulnerable service and the ability to send a crafted serialized object. No authentication, special privileges, or user interaction is required. The attack can be automated and executed at scale, making it a practical threat for internet-facing deployments.

Remediation

Upgrade Controller to a patched version released by the vendor. Consult the vendor advisory for the specific patched version number and deployment instructions. As an interim measure, restrict network access to the Controller service using firewall rules or network segmentation to limit exposure to untrusted sources.

Patch guidance

Contact your vendor to obtain the patched version of Controller. Verify the patch version against the official security advisory before deployment. Test the patched version in a non-production environment to confirm compatibility with your existing configuration and integrations. Schedule a maintenance window to deploy the patch to production systems, prioritizing those in high-availability or customer-facing roles.

Detection guidance

Monitor Controller logs for repeated connection attempts, unexpected deserialization errors, or application crashes from unauthenticated sources. Network-based detection could identify repeated attempts to send malformed serialized payloads to the vulnerable endpoint. Baseline normal application behavior and alert on anomalies in service availability or resource consumption. Review access logs for any requests originating from unexpected IP ranges.

Why prioritize this

This vulnerability merits high priority due to its network accessibility, ease of exploitation, and direct impact on service availability. No authentication is required, and the attack surface is large for internet-facing instances. Organizations should patch promptly to avoid potential service disruptions.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects the combination of network-accessible attack vector, low complexity, and denial-of-service impact on availability. The score does not account for confidentiality or integrity, which are not affected. In environments where Controller availability is critical or service downtime carries significant business cost, the operational risk may exceed the base CVSS score.

Frequently asked questions