CVE-2026-57527: ZAP ViewState Add-on Insecure Deserialization – Code Execution Vulnerability

Technical summary

The ViewState add-on's JSFViewState.decode() method processes the javax.faces.ViewState HTTP parameter by base64-decoding its value and passing it directly to ObjectInputStream.readObject(). This unsafe deserialization occurs without a deserialization filter, allowlist, or type validation. When the ZAP Desktop UI renders the ViewState panel, the malicious serialized Java object is instantiated within the ZAP JVM, enabling arbitrary code execution. The vulnerability stems from CWE-502 (Deserialization of Untrusted Data) and affects any analyst using the add-on to inspect JSF-based applications.

Business impact

For security teams and penetration testers relying on ZAP, this vulnerability creates a significant supply-chain risk. An attacker who identifies an organization uses ZAP for testing can inject malicious payloads into responses from target applications, compromising the analyst's workstation or the testing environment. This could lead to theft of source code, test credentials, proxy logs containing sensitive application behavior, or lateral movement into the broader security infrastructure. The impact is elevated because ZAP runs with the privileges of the user, potentially affecting administrative accounts used for security assessments.

Affected systems

The vulnerability affects Zed Attack Proxy ViewState add-on versions prior to version 4. It is triggered only when analysts actively use the tool to proxy traffic from and inspect responses of JavaServer Faces (JSF) applications that include a ViewState parameter. The attack requires either server-side control or a network position allowing response manipulation, limiting exposure to scenarios where attackers have already compromised or can intercept traffic from a target application.

Exploitability

While the technical barrier to exploitation is low—crafting a malicious serialized Java object and embedding it in a ViewState parameter is well within the capability of experienced attackers—the attack requires user interaction. An analyst must view the affected response in ZAP's UI, and the attacker must either control the proxied web server or be able to intercept and modify responses in transit. The CVSS score of 8.8 (HIGH) reflects the high impact of code execution offset by the requirement for user action and network access to a proxied server.

Remediation

Upgrade the ViewState add-on to version 4 or later. Users should verify their ZAP installation includes the updated add-on and confirm the version in the add-ons marketplace or plugin manager. Until patched, organizations should restrict ZAP use to secure, trusted networks and consider segmenting security testing workstations to limit blast radius if compromise occurs. Additionally, avoid proxying untrusted or hostile web applications through ZAP until the patch is deployed.

Patch guidance

Update the ViewState add-on to version 4 or newer through the ZAP add-ons marketplace. Check the ZAP Help menu for add-on management tools, search for 'ViewState,' and install the latest available version. Verify the patch is applied by confirming the add-on version displays as 4.0 or higher in the installed add-ons list. For organizations managing ZAP deployments centrally, verify patch distribution to all testing workstations and confirm version compliance via inventory or automated scanning.

Detection guidance

Monitor ZAP instances for the ViewState add-on version using inventory management tools or by scripting queries against ZAP's plugin metadata. Look for instances running add-on versions below 4. In network-based detection, monitor for unusual process execution or file writes originating from ZAP processes, particularly if ZAP is proxying untrusted applications. Log all add-on installations and updates to establish a baseline of expected versions.

Why prioritize this

Although not yet listed on CISA's KEV catalog, this vulnerability warrants high priority because it affects a trust-critical tool widely used by security professionals. Compromise of ZAP directly compromises the security team's ability to assess applications and access to their testing credentials and logs. The attack surface, while requiring user action, is realistic in penetration testing scenarios where analysts routinely inspect responses from potentially hostile applications. Organizations should treat this as urgent within their security testing infrastructure.

Risk score, explained

The CVSS 8.8 HIGH score reflects the combination of network-based attack vector, low attack complexity, no required privileges, and user interaction that triggers high-impact code execution. The score appropriately weights the severe consequences—full confidentiality, integrity, and availability compromise of the ZAP process—against the requirement that an analyst must view the malicious response. For security teams, the practical risk is further elevated by ZAP's role as a foundational testing tool.

Frequently asked questions