CVE-2026-38950: ESA AnomalyMatch Arbitrary Code Execution via Unsafe PyTorch Deserialization

Technical summary

CVE-2026-38950 is a code injection vulnerability in ESA AnomalyMatch that exploits insecure deserialization practices. The application uses PyTorch's torch.load() function without restrictions, which inherently deserializes Python pickle data embedded in model checkpoint files. Since pickle can encode and execute arbitrary Python code during deserialization, an attacker can craft a malicious .pth or checkpoint file containing embedded code that executes upon loading. The vulnerability affects model files stored in session directories, making it a local attack vector that requires prior access to the system or a mechanism to stage files where the application will load them.

Business impact

Organizations relying on ESA AnomalyMatch for anomaly detection face direct code execution risk if attackers gain local file system access or if the application accepts user-supplied model files. Compromise could lead to data exfiltration, lateral movement within the network, poisoning of detection results (undermining the tool's core function), or deployment of persistent backdoors. The impact is particularly severe in environments where AnomalyMatch runs with elevated privileges or has access to sensitive data streams.

Affected systems

ESA AnomalyMatch versions prior to 1.3.1 are vulnerable. Organizations should verify their installed versions and prioritize upgrades. The vulnerability requires local system access to exploit, limiting the attack surface to authenticated users or attackers who have already compromised the host system where AnomalyMatch runs.

Exploitability

Exploitation requires local access (CVSS vector specifies AV:L), meaning an attacker must already be on the system or able to write files to directories the application accesses. The barrier to exploitation is low once access is gained—crafting a malicious PyTorch checkpoint is straightforward for attackers with Python knowledge. However, the attack does not require user interaction beyond normal application operation (UI:N), and no complex configuration is needed (AC:L). The primary constraint is the prerequisite of local presence or file write capability.

Remediation

Upgrade ESA AnomalyMatch to version 1.3.1 or later immediately. Verify the upgrade path with the vendor's advisory to confirm compatibility and any additional steps. After patching, restart all instances of the application. As a compensating control, restrict file system permissions on session directories and model repositories to prevent unauthorized file writes, and audit access logs for suspicious model file uploads or loads.

Patch guidance

Apply the vendor's security update to upgrade ESA AnomalyMatch to version 1.3.1 or later. Consult ESA's official advisory for supported upgrade paths, potential breaking changes, and any required configuration adjustments. Test the patch in a staging environment first to ensure compatibility with your deployment. Plan for service restarts during the maintenance window. Verify the patched version using package managers or vendor-supplied checksums.

Detection guidance

Monitor for creation or modification of model checkpoint files (.pth, .pkl, or similar) in AnomalyMatch session directories, particularly from unexpected sources or users. Alert on unsuccessful torch.load() errors or exceptions that may indicate malformed or suspicious model files. Review audit logs for changes to model repositories and track who initiated model loads. Endpoint detection and response (EDR) tools should flag suspicious child processes spawned by the AnomalyMatch application process, which may indicate exploitation. Network monitoring can detect data exfiltration if the injected code attempts outbound communication.

Why prioritize this

This vulnerability merits rapid patching despite its local-access requirement. Code execution is the most severe outcome, and the deserialization flaw is trivial to exploit given access. Organizations should treat this as high-priority if they run AnomalyMatch on multi-user systems, shared infrastructure, or where other vulnerabilities could provide an attacker with initial local access. The lack of KEV status does not diminish the urgency; patch promptly within your normal high-severity cycle.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects complete compromise of confidentiality, integrity, and availability once the attacker executes code. The local-access vector (AV:L) prevents remote exploitation, lowering the score below critical. However, low attack complexity (AC:L) and no privileges required beyond local presence (PR:L) mean exploitation is straightforward. The true risk depends on your environment's access controls and whether AnomalyMatch is exposed to multi-tenant or untrusted-user scenarios.

Frequently asked questions